Understanding Message Security in the Enterprise Server
TheEnterprise Server oers integrated support for the WS-Security standard in its web services
clientand server-side containers. This functionality is integrated such that web services security
isenforced by the containers of the Enterprise Server on behalf of applications, and such that it
canbe applied to protect any web service application without requiring changes to the
implementationof the application. The Enterprise Server achieves this eect by providing
facilitiesto bind SOAP layer message security providers and message protection policies to
containersand to applications deployed in containers.

Assigning Message Security Responsibilities

Inthe Enterprise Server, the “System Administrator” on page 128 and “Application Deployer”
onpage 129 roles are expected to take primary responsibility for conguring message security.
Insome situations, the “Application Developer” on page 129 may also contribute, although in
thetypical case either of the other roles may secure an existing application without changing its
implementationwithout involving the developer. The responsibilities of the various roles are
denedin the following sections:
■“SystemAdministrator” on page 128
■“ApplicationDeployer” on page 129
■“ApplicationDeveloper” on page 129

SystemAdministrator

Thesystem administrator is responsible for:
■Conguringmessage security providers on the Enterprise Server.
■Managinguser databases.
■Managingkeystore and truststore les.
■Conguringa Java Cryptography Extension (JCE) provider if using encryption and running
aversion of the Java SDK prior to version 1.5.0.
■Installingthe samples server. This is only done if the xms sample application will be used to
demonstratethe use of message layer web services security.
Asystem administrator uses the Admin Console to manage server security settings and uses a
commandline tool to manage certicate databases. In Platform Edition, certicates and private
keysare stored in key stores and are managed with keytool. Standard Edition and Enterprise
Editionstore certicates and private keys in an NSS database, where they are managed using
certutil.This document is intended primarily for system administrators. For an overview of
messagesecurity tasks, see “Conguring the Enterprise Server for Message Security” on
page133.
UnderstandingMessage Security in the Enterprise Server
SunGlassFishEnterprise Ser ver2.1 Administration Guide • December 2008128