Configure the server to validate identity assertion authentication information: WAS v5.1

Configure the server to validate identity assertion authentication information

Use this task to configure identity assertion authentication. The purpose of identity assertion is to assert the authenticated identity of the originating client from a Web service to a downstream Web service. Do not attempt to configure identity assertion from a pure client.
For the downstream Web service to accept the identity of the originating client (user name only), supply a special trusted BasicAuth credential that the downstream Web service trusts and can authenticate successfully. You must specify the user ID of the special BasicAuth credential in a trusted ID evaluator on the downstream Web service configuration. For more information on trusted ID evaluators, see Trusted ID evaluators. The server side passes the special BasicAuth credential into the trusted ID evaluator, which returns a true or false response that this ID is trusted. Once it is trusted, the user name of the client is mapped to the credential, which is used for authorization.
Complete the following steps to validate the identity assertion authentication information...

Launch the Assembly Toolkit.
Open the J2EE perspective by clicking Window > Open Perspective > Other > J2EE.
Select the Web services-enabled Enterprise JavaBean (EJB) or Web module.
In the Project Navigator window, locate the META-INF directory for an EJB module or the WEB-INF directory for a Web module.
Right-click the webservices.xml file, and click Open With > Web Services Editor.
Click the Binding Configurations tab, which is located at the bottom of the Web services editor within the Assembly Toolkit.
Expand the Request Receiver Binding Configuration Details > Login Mapping section.
Click Edit to view the login mapping information. Click Add to add new login mapping information. The login mapping dialog is displayed. Select or enter the following information...

Authentication method Specifies the type of authentication that occurs. Select IDAssertion to use basic authentication.

Configuration name Specifies the JAAS login configuration name. For the IDAssertion authentication method, enter system.wssecurity.IDAssertion for the JAAS login configuration name.

Use token value type Determines if you want to specify a custom token type. For the default authentication method selections, you do not need to specify this option.

Token value type URI and Token value type local name When you select ID assertion, you cannot edit the token value type URI and local name values. Specifies custom authentication types. For the ID assertion authentication method, leave these values blank.

Callback Handler Factory Class name Ccreates a JAAS CallbackHandler implementation that understands the following callbacks:

javax.security.auth.callback.NameCallback
javax.security.auth.callback.PasswordCallback
com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback
com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback
com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback

For any of the default authentication methods (BasicAuth, IDAssertion, and Signature), use the callback handler factory default implementation. Enter the following class name for any of the default Authentication methods including IDAssertion:
com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl

This implementation creates the correct callback handler for the default implementations.

Callback handler factory property name and Callback handler factory property value Specifies callback handler properties for custom callback handler factory implementations. The default callback handler factory implemetation does not need any specified properties. For ID assertion, leave these values blank.

Login mapping property name and Login mapping property value Specifies properties for a custom login mapping. For the default implementations including IDAssertion, leave these values blank.

Expand the Trusted ID Evaluator section.
Click Edit to see a dialog that displays all the trusted ID evaluator information. The following table describes the purpose of this information.

Class name Refers to the implementation of the trusted ID evaluator that you want to use. Enter the default implementation as com.ibm.wsspi.wssecurity.id.TrustedIDEvaluatorImpl. If you want to implement your own trusted ID evaluator, implement the com.ibm.wsspi.wssecurity.id.TrustedIDEvaluator interface.

Property name Represents the name of this configuration. Enter BasicIDEvaluator.

Property value Defines the name and value pairs that can be used by the trusted ID evaluator implementation. For the default implementation, the trusted list is defined here. When a request comes in and the trusted ID is verified, the user ID, as it appears in the user registry, must be listed in this property. Specify the property as a name and value pair where the name is trustedId_n. n is an integer starting from 0 and the value is the user ID associated with that name. An example list with the trusted names include two properties.
For example: trustedId_0 = user1, trustedId_1 = user2. The previous example means that both user1 and user2 are trusted. user1 and user2 must be listed in the configured user registry.

Expand the Trusted ID Evaluator Reference section.
Click Enable to add a new entry.The text you enter for the Trusted ID Evaluator Reference must be the same as the name entered previously in the Trusted ID Evaluator. Make sure that the name matches exactly because the information is case sensitive. If an entry is already specified, you can change it by clicking Edit.

You must specify how the server handles the identity assertion authentication method. See Configuring the server to handle identity assertion authentication if you have not previously specified this information.

See Also
Trusted ID evaluator
Securing Web services using identity assertion authentication
Configuring the server to handle identity assertion authentication
Configuring the server security bindings using the Assembly Toolkit

Authentication method	Specifies the type of authentication that occurs. Select IDAssertion to use basic authentication.
Configuration name	Specifies the JAAS login configuration name. For the IDAssertion authentication method, enter system.wssecurity.IDAssertion for the JAAS login configuration name.
Use token value type	Determines if you want to specify a custom token type. For the default authentication method selections, you do not need to specify this option.
Token value type URI and Token value type local name	When you select ID assertion, you cannot edit the token value type URI and local name values. Specifies custom authentication types. For the ID assertion authentication method, leave these values blank.
Callback Handler Factory Class name	Ccreates a JAAS CallbackHandler implementation that understands the following callbacks: javax.security.auth.callback.NameCallback javax.security.auth.callback.PasswordCallback com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback For any of the default authentication methods (BasicAuth, IDAssertion, and Signature), use the callback handler factory default implementation. Enter the following class name for any of the default Authentication methods including IDAssertion: com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl This implementation creates the correct callback handler for the default implementations.
Callback handler factory property name and Callback handler factory property value	Specifies callback handler properties for custom callback handler factory implementations. The default callback handler factory implemetation does not need any specified properties. For ID assertion, leave these values blank.
Login mapping property name and Login mapping property value	Specifies properties for a custom login mapping. For the default implementations including IDAssertion, leave these values blank.

Class name	Refers to the implementation of the trusted ID evaluator that you want to use. Enter the default implementation as com.ibm.wsspi.wssecurity.id.TrustedIDEvaluatorImpl. If you want to implement your own trusted ID evaluator, implement the com.ibm.wsspi.wssecurity.id.TrustedIDEvaluator interface.
Property name	Represents the name of this configuration. Enter BasicIDEvaluator.
Property value	Defines the name and value pairs that can be used by the trusted ID evaluator implementation. For the default implementation, the trusted list is defined here. When a request comes in and the trusted ID is verified, the user ID, as it appears in the user registry, must be listed in this property. Specify the property as a name and value pair where the name is trustedId_n. n is an integer starting from 0 and the value is the user ID associated with that name. An example list with the trusted names include two properties. For example: trustedId_0 = user1, trustedId_1 = user2. The previous example means that both user1 and user2 are trusted. user1 and user2 must be listed in the configured user registry.