WS-Security model in WAS v5.x

WS-Security model in WAS v5.x

+
Search Tips | Advanced Search

The WS-Security model used by WAS is the declarative model. WAS does not include any APIs for programmatically interacting with WS-Security. However, a few Server Provider Interfaces (SPIs) are available for extending some security-related behaviors.
There is an important distinction between V 5.x and V6 and later applications. The information in this article supports V5.x applications only that are used with WAS V6.0.x and later. The information does not apply to V6 and later applications.

The security constraints for WS-Security are specified in IBM deployment descriptor extensions for Web services. The WS-Security run time acts on the constraints to enforce WS-Security for the SOAP message. The scope of the IBM deployment descriptor extension is at the EJB or Web module level. Bindings are associated with each of the following IBM deployment descriptor extensions:

Client (Might be either a Java EE client (application client container) or Web services acting as a client)

ibm-webservicesclient-ext.xmi

ibm-webservicesclient-bnd.xmi

Server

ibm-webservices-ext.xmi

ibm-webservices-bnd.xmi

IBM recommends that you use the assembly tools provided by IBM to create the IBM deployment descriptor extension and bindings. After the bindings are created, we can use the admin console or an assembly tool to specify the bindings.
The binding information is collected after application deployment rather than during application deployment.
The alternative is to specify the required binding information before deploying the application.

The WS-Security run time enforces WS-Security based on the defined security constraints in the deployment descriptor and binding files. WS-Security has the following four points where it intercepts the message and acts on the security constraints defined:

Message points Description
Request sender (defined in the ibm-webservicesclient-ext.xmi and ibm-webservicesclient-bnd.xmi files)

Applies the appropriate security constraints to the SOAP message (such as signing or encryption) before the message is sent, generating the time stamp or the required security token.

Request receiver (defined in the ibm-webservices-ext.xmi and ibm-webservices-bnd.xmi files)

Verifies that the Web services security constraints are met.
Verifies the freshness of the message based on the time stamp. The freshness of the message indicates whether the message complies with predefined time constraints.
Verifies the required signature.
Verifies that the message is encrypted and decrypts the message if encrypted.
Validates the security tokens and sets up the security context for the downstream call.

Response sender (defined in the ibm-webservices-ext.xmi and ibm-webservices-bnd.xmi files)

Applies the appropriate security constraints to the SOAP message response, like signing the message, encrypting the message, or generating the time stamp.

Response receiver (defined in the ibm-webservicesclient-ext.xmi or ibm-webservicesclient-bnd.xmi files)

Verifies that the Web services security constraints are met.
Verifies the freshness of the message based on the time stamp. The freshness of the message indicates whether the message complies with predefined time constraints.
Verifies the required signature.
Verifies that the message is encrypted and decrypts the message, if encrypted.

Related concepts
WS-Security specification—a chronology
WS-Security and J2EE security relationship

Related tasks
Secure Web services for V5.x applications based on WS-Security

Related
WS-Security support

Message points	Description
Request sender (defined in the ibm-webservicesclient-ext.xmi and ibm-webservicesclient-bnd.xmi files)	Applies the appropriate security constraints to the SOAP message (such as signing or encryption) before the message is sent, generating the time stamp or the required security token.
Request receiver (defined in the ibm-webservices-ext.xmi and ibm-webservices-bnd.xmi files)	Verifies that the Web services security constraints are met. Verifies the freshness of the message based on the time stamp. The freshness of the message indicates whether the message complies with predefined time constraints. Verifies the required signature. Verifies that the message is encrypted and decrypts the message if encrypted. Validates the security tokens and sets up the security context for the downstream call.
Response sender (defined in the ibm-webservices-ext.xmi and ibm-webservices-bnd.xmi files)	Applies the appropriate security constraints to the SOAP message response, like signing the message, encrypting the message, or generating the time stamp.
Response receiver (defined in the ibm-webservicesclient-ext.xmi or ibm-webservicesclient-bnd.xmi files)	Verifies that the Web services security constraints are met. Verifies the freshness of the message based on the time stamp. The freshness of the message indicates whether the message complies with predefined time constraints. Verifies the required signature. Verifies that the message is encrypted and decrypts the message, if encrypted.