IBM BJ0NJML Integration Guide - Page 197

Web Services, Securing Web Services, the application server with the appropriate digital certificates.

Page 197 highlights

Web Services Object Structure Service Servlet Object Structure Service Servlet (HTTP POST) accessible by authorized users /os/* GET POST Roles that have access to Object Structure Service Servlet (HTTP POST) maximouser data transmission gaurantee NONE --> The preceding section refers to a single role, maximouser, which is defined farther down in the web.xml file. By default, the security constraint section is not commented out. An Integration User maximouser In addition, change the following web.xml value for useAppServerSecurity from 0 to 1 in the web.xml: Indicates whether to use Application Server security or not useAppServerSecurity java.lang.String 0 You can securely deploy a Web service by using SSL (HTTPS). Set up the SSL in the application server with the appropriate digital certificates. Web Services You can secure integration Web services by using HTTP basic authentication in standard J2EE security. These security settings let authorized users with a valid user name and password access Web services. Securing Web Services Security To enable Web service security, use the steps previously described for HTTP, referencing the following Web service-specific security-constraint blocks. The application web.xml file contains a section for the web service invocation. By default, this section is commented out. 183

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330

Web Services
Security
183
<web-resource-name>Object Structure Service Servlet</web-
resource-name>
<description>Object Structure Service Servlet (HTTP POST)
accessible by authorized users</description>
<url-pattern>/os/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<description>Roles that have access to Object Structure
Service Servlet (HTTP POST)</description>
<role-name>maximouser</role-name>
</auth-constraint>
<user-data-constraint>
<description>data transmission gaurantee</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
-->
The preceding <security-constraint> section refers to a single role,
maximouser
,
which is defined farther down in the web.xml file. By default, the security
constraint section is not commented out.
<security-role>
<description>An Integration User</description>
<role-name>maximouser</role-name>
</security-role>
In addition, change the following web.xml value for useAppServerSecurity from
0 to 1 in the web.xml:
<description>Indicates whether to use Application Server security
or not</description>
<env-entry-name>useAppServerSecurity</env-entry-name>
<env-entry-type>java.lang.String</env-entry-type>
<env-entry-value>0</env-entry-value>
</env-entry>
You can securely deploy a Web service by using SSL (HTTPS). Set up the SSL in
the application server with the appropriate digital certificates.
Web Services
You can secure integration Web services by using HTTP basic authentication in
standard J2EE security. These security settings let authorized users with a valid
user name and password access Web services.
Securing Web Services
To enable Web service security, use the steps previously described for HTTP,
referencing the following Web service-specific security-constraint blocks.
The application web.xml file contains a <security-constraint> section for the web
service invocation. By default, this section is commented out.