Conguring Message Security
Someof the material in this chapter assumes a basic understanding of security and web services
concepts.This chapter describes the conguration of message layer security for web services in
theEnterprise Server. This chapter contains the following topics:
■“Overviewof Message Security” on page 127
■“UnderstandingMessage Security in the Enterprise Server” on page 128
■“Securinga Web Service” on page 132
■“Securingthe Sample Application” on page 133
■“Conguringthe Enterprise Server for Message Security” on page 133
■“MessageSecurity Setup” on page 137

Overview of Message Security

Inmessage security, security information is inserted into messages so that it travels through the
networkinglayers and arrives with the message at the message destination(s). Message security
diersfrom transport layer security (which is discussed in the Security chapter of the Java EE
5.0Tutorial) in that message security can be used to decouple message protection from message
transportso that messages remain protected after transmission.
WebServices Security: SOAP Message Security (WS-Security) is an international standard for
interoperableWeb Services Security that was developed in OASIS by a collaboration of all the
majorproviders of web services technology (including Sun Microsystems). WS-Security is a
messagesecurity mechanism that uses XML Encryption and XML Digital Signature to secure
webservices messages sent over SOAP.The WS-Security specication denes the use of various
securitytokens including X.509 certicates, SAML assertions, and username/password tokens
toauthenticate and encrypt SOAP web services messages.
TheWS-Security specication can be viewed at
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf.
10
CHAPTER 10
127