Digital signing methods using the WSSSignature API

Configure the signing information for the generator binding using the WSS API. To configure the client for request signing, choose the digital signing methods. The algorithm methods include the signing and canonicalization methods.

You must configure generator signing information to protect message integrity by digitally signing SOAP messages. Integrity refers to digital signature while confidentiality refers to encryption. Integrity decreases the risk of data modification when you transmit data across a network.

After we have specified which message parts to digitally sign, specify which method is used to digitally sign the message.

 

Methods

Methods that are used for the signing information include the:

Signature method

Sets the signature algorithm method.

Canonicalization method

Sets the canonicalization algorithm method.

 

Signature algorithms

The signature algorithms specify the algorithm used to sign the certificate. The signature algorithms specify the Uniform Resource Identifiers (URI) of the signature method. WAS supports the following pre-configured algorithms:

Table 1. Signature algorithms

Algorithm	Description
WSSSignature.HMAC_SHA1	A URI of the signature algorithm, HMAC: http://www.w3.org/2000/09/xmldsig#hmac-sha1
WSSSignature.RSA_SHA1 (the default value)	A URI of the signature algorithm, RSA: http://www.w3.org/2000/09/xmldsig#rsa-sha1

For the WSS APIs, WAS does not support the DSA-SHA1 algorithm, http://www.w3.org/2000/09/xmldsig#dsa-sha1

The signing algorithm specified for the request generator configuration must match the algorithm specified for the request consumer configuration.

 

Canonicalization algorithms

The canonicalization algorithms specify the Uniform Resource Identifiers (URI) of the canonicalization method. WAS supports the following pre-configured algorithms:

Table 2. Signature canonicalization algorithms

Algorithm	Description
WSSSignature.EXC_C14N (the default value)	A URI of the exclusive canonicalization algorithm EXC_C14N: http://www.w3.org/2001/10/xml-exc-c14n#
WSSSignature.C14N	A URI of the inclusive canonicalization algorithm, C14N: http://www.w3.org/2001/10/xml-c14n#

The canonicalization algorithm specified for the request generator configuration must match the algorithm specified for the request consumer configuration.

 

Example

The following example provides sample WSS API code that specifies the HMAC_SHA1 as a signature method and C14n as a canonicalization method:

    
//generate WSSFactory instance 
    WSSFactory factory = WSSFactory.getInstance();    
        
    
//generate WSSGenerationContext instance 
    WSSGenerationContext gencont = factory.newWSSGenerationContext();
    
    
//generate callback handler
    X509GenerateCallbackHandler callbackHandler = new 
        X509GenerateCallbackHandler(
        "",         "dsig-sender.ks",         "jks", 
        "client".toCharArray(), 
        "soaprequester", 
        "client".toCharArray(), 
        "CN=SOAPRequester, OU=TRL, O=IBM, ST=Kanagawa, C=JP", 
        null);
    
    
//generate the security token used to the signature
    SecurityToken token = factory.newSecurityToken(X509Token.class, 
        callbackHandler);

    
//generate WSSSignature instance
    WSSSignature sig = factory.newWSSSignature(token);
    
    
//set the canonicalization method 
    
// DEFAULT: WSSSignature.EXC_C14N
    sig.setCanonicalizationMethod(WSSSignature.C14N);
    
    
//set the signature method  
    
// DEFAULT: WSSSignature.RSA_SHA1
    sig.setSignatureMethod(WSSSignature.HMAC_SHA1);
    
    
//add the WSSSignature to the WSSGenerationContext 
    gencont.add(sig);
    
    
//generate the WS-Security header 
    gencont.process(msgcontext);

---

 

Related tasks

Add signed parts using the WSSSignPart API
Set generator signing information to protect message integrity using the WSS APIs

 

Related

Signed parts methods using the WSSSignPart API
Choose the verify parts methods using the WSSVerifyPart API
Signature verification methods using the WSSVerification API