Web services security and WAS

WAS Version 4, Version 5, and Version 5.0.1 support digital signature for Apache SOAP Version 2.x. However, the strategic direction for IBM is based on the Web services security specification, Web Services Security (WS-Security), proposed by IBM, Microsoft, and Verisign in April 2002. Starting with Version 5.0.2, WAS supports Web services security. The implementation is based on the IBM Web services engine.

Web services security is a SOAP message-level security specification that is used to support security token propagation, message integrity, and message confidentiality. One intent of the specification is to address interoperability between different implementations of Web services security.

To realize the benefits of Web services security, it is recommended that an implementation of the specification is integrated with underlying security mechanisms. This implementation is fully integrated with the WAS security infrastructure. Authorization, for example, is based on the J2EE security model. When a user ID and password are embedded in a request message, authentication is performed with the user ID and password. If successful, a user identity is established in the context and further resource access is authorized on that identity. After the user ID and password are authenticated by the Web services security run time, a J2EE container performs authorization.

WAS provides an implementation of the key features of Web services security based on the following specifications:

The following is a summary of Web services security elements supported by WAS:

Table 1: Web services security elements

Element Notes
UsernameToken Both the user name and password for the BasicAuth authentication method and the user name for the identity assertion authentication method are supported. WAS does not support the Password Digest, Nonce, and Created attributes.
BinarySecurityToken X.509 certificates and LTPA can be imbedded, but there is no implementation to imbed Kerberos tickets. However, the binary token generation and validation are pluggable and are based on the Java Authentication and Authorization Service (JAAS) APIs. You can extend this implementation to generate and validate other types of binary security tokens.
Signature The X.509 certificate is imbedded as a BinarySecurityToken and can be referenced by the SecurityTokenReference. WAS does not support shared, key-based signature.
Encryption Both the EncryptedKey and ReferenceList XML tags are supported. KeyIdentifier specifies public keys and KeyName identifies the secret keys. WAS has the capability to map an authenticated identity to a key for encryption or use the signer certificate to encrypt the response message.
Timestamp WAS supports the Created and Expires attributes. The freshness of the message is checked only if the Expires attribute is present in the message. WAS does not support the Received attribute, which is defined in the addendum. Instead, WAS uses the TimestampTrace Received attribute, which is defined in the OASIS specification.
XML based token You can insert and validate an arbitrary format of XML tokens into a message. This format mechanism is based on the JAAS APIs.

Signing and encrypting attachments is not supported in WAS. The namespaces used for sending a message were published by OASIS in draft 13. However, the Web services security run time in WAS can accept any of the following namespaces:

WAS provides the following capability for Web services security:

For a description of capabilities that are not supported, see Table 1: Web services security elements.