Portal, Express Beta Version 6.1 Operating systems: i5/OS, Linux,Windows

Configuring the Producer portal for WS-Security authentication

After you have exported the portal EAR file and imported it into the assembly tool, you can now make the modifications required to configure your Producer portal for Web services security (WS-Security) authentication.

Fast path: Using one of the sample WS-Security configurations for the Producer portal

The portal provides a set of sample security token configurations that correspond to the default security profiles for the WSRP Consumer.

• Linux: ./ConfigEngine.sh copy-samples –DCategoriesList=wp.wsrp.producer –DDestination=directory in the wp_profile/ConfigEngine directory
• i5/OS: ConfigEngine copy-samples –DCategoriesList=wp.wsrp.producer –DDestination=directory in the profiles/wp_profile/ConfigEngine directory
• Windows: ConfigEngine.bat copy-samples –DCategoriesList=wp.wsrp.producer –DDestination=directory in the wp_profile\ConfigEngine directory

LTPA_Token

Producer configuration for LTPA token forwarding. This works only if the Consumer and Producer portals share the same user registry and LTPA configuration. The Producer portal expects the Consumer portal to propagate the LTPA token information of the current user in the WS-Security SOAP header and uses this information to establish a security context.

Username_Token

Producer configuration for Username token forwarding. This configuration expects the Consumer portal to propagate the clear text username in the WS-Security SOAP header and creates a security context based on this asserted identity.

Signed_Username_Token

Producer configuration for Username token forwarding including a signature, nonce, and timestamp. The Producer portal expects only the security token to be signed by using the following algorithms according to the WS Basic Security Profile recommendations:

Transformation

exclusive c14n. Refer to
http://www.w3.org/2001/10/xml-exc-c14n#.

Canonicalization

exclusive c14n. Refer to
http://www.w3.org/2001/10/xml-exc-c14n#.

Digest

sha-1. Refer to
http://www.w3.org/2000/09/xmldsig#sha1.

Signature

rsa-sha1. Refer to
http://www.w3.org/2000/09/xmldsig#rsa-sha1.

The trust store that contains the signer certificates to decrypt the digest and signature is NodeDefaultTrustStore. It is taken from the default SSL settings in the WebSphere Application Server configuration.

• Modifying the Web services security extensions on the Producer portal
• Modifying the Web services security bindings on the Producer portal

For more general and detailed background information about configuring WS-Security while assembling Web services applications refer to the WebSphere Application Server information center under the locations given below.

Modifying the Web services security extensions on the Producer portal

As part of specifying the WS-Security for a Producer portal, you add the necessary Producer Web service security extensions.

1. In the J2EE perspective, project explorer, expand the WebServices > Services subtree.
2. Open the service descriptor WSRPService with the WebServices Editor. It is the default.

   Alternatively, you can open the service descriptor by opening Dynamic Web Projects > wps > Web Content > WEB-INF > webservices.xml, where wps is the WAR file name that you assigned when you imported the portal EAR file into the assembly tool in a previous step.

3. In the Web Services editor navigate to the tab Extensions.
4. For every port that requires WS-Security authentication, select the port in the Port Component Binding section.
5. Select Request Consumer Service Configuration Details > Required Security Token.
6. Click Add to add a new token.
7. In the pop-up Required Security Token dialog, proceed by the following steps:

   1. Assign a unique name to the token.
   2. Select the appropriate token as the token type from the drop-down list.
   3. Click OK to leave the dialog.
8. For every port that requires WS-Security authentication, select the port in the Port Component Binding section. UnderRequest Consumer Service Configuration Details > Caller Part, click Add to add a caller part definition. In the pop-up Caller Part dialog, proceed with the following steps:

   1. Assign the caller a unique name.
   2. From the drop-down list select the appropriate token as the token type.
   3. Click OK to leave the dialog.
9. Click Save to save your changes in the service descriptor.

Modifying the Web services security bindings on the Producer portal

As part of specifying the LTPA authentication for a Producer portal, you add the necessary Producer security binding information.

1. In the J2EE perspective, project explorer, expand theWebServices > Services subtree.
2. Open the service descriptor WSRPService with the WebServices Editor. It is the default.

   Alternatively, you can open the service descriptor by opening Dynamic Web Projects > wps > Web Content > WEB-INF > webservices.xml, where wps is the WAR file name that you assigned when you imported the portal EAR file into the assembly tool in a previous step.

3. In the Web Services editor navigate to the tab Binding Configurations.
4. For every port that requires WS-Security authentication, select the port in the Port Component Binding section.
5. Select Request Consumer Binding Configuration Details > Token Consumer.
6. Click Add to add a new token Consumer.
7. In the pop-up Token Consumer dialog, proceed by the following steps:

   1. Assign a unique name to the token Consumer.
   2. Select the appropriate class as the token Consumer class from the drop-down list.
   3. Select the security token to which this token Consumer applies. The security token name is the name of the token that you assigned in the Web service security extensions for the portType that you are configuring.
   4. From the drop-down list select the appropriate value type.
   5. Click OK to leave the dialog.
8. Click Save to save your changes in the service descriptor.