Use an assembly tool to configure trust anchors (that specify keystores
which contain trusted root certificates to validate the signer certificate)
or trust stores at the application level.
Before you begin
Important: There is an important distinction between Version
5.x and Version 6 and later applications. The information in this article
supports Version 5.x applications only that are used with WebSphere
Application Server Version 6.0.x and later. The information does not
apply to Version 6.0.x and later applications.
This document
describes how to configure trust anchors or trust stores at the application
level. It does not describe how to configure trust anchors at the server
or cell level. Trust anchors defined at the application level have a higher
precedence over trust anchors defined at the server or cell level. You can
configure an application-level trust anchor using an assembly tool or the
administrative console. This document describes how to configure the application-level
trust anchor using an assembly tool. For more information on creating and
configuring trust anchors at the server or cell level, see either Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console.
About this task
A trust anchor specifies keystores that contain trusted root certificates,
which validate the signer certificate. These keystores are used by the request
receiver (as defined in the ibm-webservices-bnd.xmi file) and the
response receiver (as defined in the application-client.xml file
when Web services is acting as client) to validate the signer certificate
of the digital signature. The keystores are critical to the integrity of the
digital signature validation. If they are tampered with, the result of the
digital signature verification is doubtful and comprised. Therefore, it is
recommended that you secure these keystores. The binding configuration specified
for the request receiver in the ibm-webservices-bnd.xmi file must
match the binding configuration for the response receiver in the application-client.xml file.
Complete
the following steps to configure trust anchors using an assembly tool.
Procedure
- Configure an assembly tool to work with a Java 2 Platform, Enterprise
Edition (J2EE) enterprise application. For more information, see Assembling applications
- Create a Web services-enabled J2EE enterprise application.
See either Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console for an introduction on how to manage Web services security
binding information on the server.
- Configure the client-side response receiver, which is defined in
the ibm-webservicesclient-bnd.xmi bindings extensions file.
- Use an assembly tool to import your J2EE application.
- Click Windows > Open Perspective > Other > J2EE.
- Click Application Client projects > application_name >
appClientModule > META-INF
- Right-click the application-client.xml file, select Open
with > Deployment Descriptor Editor, and click the WS Binding tab.
The Client Deployment Descriptor is displayed.
- Locate the Port qualified name binding section and either select
an existing entry or click Add, to add a new port binding. The
Web services client port binding editor displays for the selected port.
- Locate the Trust anchor section and click Add.
The Trust anchor window is displayed.
- Enter a unique name within the port binding for the Trust anchor name.
The
name is used to reference the trust anchor that is defined.
- Enter the keystore password, path, and keystore type.
The supported
keystore types are the Java Cryptography Extension (JCE) and Java Cryptography
Extension Keystores (JCEKS) types.
Click Edit to edit the selected trust anchor.
Click Remove to
remove the selected trust anchor.
When you start the application, the
configuration is validated in the run time while the binding information is
loading.
- Save the changes.
- Configure the server-side request receiver, which is defined in
the ibm-webservices-bnd.xmi bindings extensions file.
- Click Windows > Open perspective > J2EE.
- Select the Web services enabled Enterprise JavaBeans (EJB) or
Web module.
- In the Package Explorer window, click the META-INF directory
for an EJB module or the WEB-INF directory for a Web module.
- Right-click the webservices.xml file, select Open
with > Web services editor, and click the bindings tab. The
Web services bindings editor is displayed.
- Locate the Web service description bindings section and either
select an existing entry or click Add to add a new Web services descriptor.
- Click Binding configurations. The Web services
binding configurations editor is displayed for the selected Web services descriptor.
- Locate the Trust anchor section and click Add.
The Trust anchor dialog box is displayed.
- Enter a unique name within the binding for the Trust anchor name.
This
unique name is used to reference the trust anchor defined.
- Enter the keystore password, path, and keystore type. The supported keystore
types are JCE and JCEKS.
Click Edit to edit the selected trust anchor.
Click Remove to
remove the selected trust anchor.
When you start the application, the
configuration is validated in the run time while the binding information is
loading.
- Save the changes.
Results
This procedure defines trust anchors that can be used by the request
receiver or the response receiver (if the Web services is acting as client)
to verify the signer certificate.
Example
The request receiver or the response receiver (if the Web service
is acting as a client) uses the defined trust anchor to verify the signer
certificate. The trust anchor is referenced using the trust anchor name.