Pluggable security token support provides plug-in points to support customer security token types, including token generation, token validation, and client identity mapping to a WebSphere® Application Server identity that is used by the Java™ Platform, Enterprise Edition (Java EE) authorization engine. Moreover, the pluggable token generation and validation framework supports XML-based tokens to be inserted into the Web service message header and validated on the receiver-side validation.
You can extend the WebSphere Application Server login mapping mechanism to handle new types of authentication tokens. WebSphere Application Server provides a pluggable framework to generate security tokens on the sender-side of the message and to validate the security token on the receiver-side of the message. The framework is based on the Java Authentication and Authorization Service (JAAS) Application Programming Interfaces (APIs).
Encode the token byte by using the security handler and not by using the javax.security.auth.callback.CallbackHandler implementation.
You can implement the com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory interface, which is a factory for instantiating the javax.security.auth.callback.CallbackHandler implementation. For your own implementation, you must provide the javax.security.auth.callback.CallbackHandler interface. The Web service security run time instantiates the factory implementation class and passes the authentication information from the Web services message header to the factory class through the setter methods. The Web services security run time then invokes the newCallbackHandler() method of the factory implementation class to obtain an instance of the javax.security.auth.CallbackHandler object. The object is passed to the JAAS login configuration.
public interface com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory { public void setUsername(String username); public void setRealm(String realm); public void setPassword(String password); public void setHashMap(Map properties); public void setTokenByte(byte[] token); public void setXMLToken(Element xmlToken); public CallbackHandler newCallbackHandler();