WSS defines the binding of XML digital signatures, XML encryption, and username/password tokens to secure SOAP messages. WSS in the Application Server defines how to use WSS to secure invocations of web services, including web services deployed on our Application Server.
The WSS specification provides an extensible mechanism for associating security tokens with SOAP messages. The WSS specification itself does not define the format of the various types of security tokens. Instead, a series of security token profile documents have either been published or are in the process of being published. Each of these profile documents defines the use of a particular type of security token (e.g., X.509) to secure SOAP messages using digital signatures or encryption.
Username token verification specifies a process for sending Username tokens along with the message. The receiver can validate the identity of the sender by validating the digital signature sent by the sender. A digital signature internally refers to a security token (for example, Username token or an X.509 Certificate token) to indicate the key used for signing. Sending these tokens with a message binds the identity of the tokens (and any other claims occurring in the security token) to the message. For more information about these security tokens, see "Further Information".
Support for message layer security is integrated into the Application Server and its client containers in the form of (pluggable) authentication modules. By default, message layer security is disabled on the Application Server. To configure message layer security, follow the steps outlined in "Configuring the Application Server for Message Security".
The Application Server uses Username Tokens to deliver a user name and password and to authenticate the peer in the web service invocation. Username tokens are typically used in lieu of digital signatures. Digital signatures are used to bind an authentication identity to the message content. Username tokens are used to bind an authentication identity to a message sender.
When using a Username Token, a valid user database must be configured on the Application Server. For more information on this topic, read "Editing a Realm".
The Application Server uses XML Digital Signatures to authenticate the source of message content. Digital signatures is an authentication mechanism. Clients use digital signatures to establish their caller identity, analogous to the way basic authentication or SSL client certificate authentication have been used to do the same thing when transport layer security is being used. Digital signatures are used to enable the receiver to validate that the message has not be altered since it was signed, and as such can confirm that the signer defined the content (although they might not have sent it).
When using digital signatures, valid keystore and truststore files must be configured on the Application Server. For more information on this topic, read "About Certificate Files".
The purpose of encryption is to modify the data such that it can only be understood by its intended audience. This is accomplished by substituting an encrypted element for the original content. When predicated on public key cryptography, encryption can be used to establish the identity of the parties that can read a message.
When using Encryption, you must have an installed JCE provider that supports encryption. For more information on this topic, read "Configuring a JCE Provider".