Configure signature authentication for v5.x web services with an assembly tool

With the signature authentication method, the request sender generates a signature security token using a callback handler. The security token returned by the callback handler is inserted in the SOAP message. The request receiver retrieves the Signature security token from the SOAP message and validates it using a JAAS login module.

Subtopics

• Secure web services for version 5.x applications using signature authentication
  WebSphere Application Server provides several different methods to secure the web services. XML digital signature is one of these methods.
• Configure the client for signature authentication: specifying the method
  Signature authentication, the use of an X.509 certificate to login on the target server, can be configured.
• Configure the client for signature authentication: collecting the authentication information
  Signature authentication refers to an X.509 certificate sent by the client to the server. The certificate is used to authenticate to the user registry configured at the server. The client collects the authentication information for signature authentication.
• Configure the server to support signature authentication
  Signature authentication refers to an X.509 certificate sent by the client to the server. The certificate is used to authenticate to the user registry configured at the server. After a request is received by the server containing the certificate, the server needs to log in to form a credential. The credential is used for authorization. We can configure signature authentication at the server.
• Configure the server to validate signature authentication information
  Signature authentication refers to an X.509 certificate sent by the client to the server. The certificate is used to authenticate to the user registry configured at the server. After a request is received by the server containing the certificate, the server needs to log in to form a credential. The credential is used for authorization. We can validate signature authentication at the server.