Securing a Web Service

Web services deployed on the Enterprise Server are secured by binding SOAP layer message security providers and message protection policies to the containers in which the applications are deployed or to web service endpoints served by the applications. SOAP layer message security functionality is configured in the client-side containers of the Enterprise Server by binding SOAP layer message security providers and message protection policies to the client containers or to the portable service references declared by client applications.

When the Enterprise Server is installed, SOAP layer message security providers are configured in the client and server-side containers of the Enterprise Server, where they are available for binding for use by the containers, or by individual applications or clients deployed in the containers. During installation, the providers are configured with a simple message protection policy that, if bound to a container, or to an application or client in a container, would cause the source of the content in all request and response messages to be authenticated by XML digital signature.

The administrative interfaces of the Enterprise Server can be employed to bind the existing providers for use by the server-side containers of the Enterprise Server, to modify the message protection policies enforced by the providers, or to create new provider configurations with alternative message protection policies. Analogous administrative operations can be performed on the SOAP message layer security configuration of the application client container as defined in Enabling Message Security for Application Clients.

By default, message layer security is disabled on the Enterprise Server. To configure message layer security for the Enterprise Server follow the steps outlined in Configuring the Enterprise Server for Message Security. If you want to cause web services security to be used to protect all web services applications deployed on the Enterprise Server, follow the steps in Enabling Providers for Message Security.

Once you have completed the above steps (which may include restarting the Enterprise Server), web services security will be applied to all web services applications deployed on the Enterprise Server.

Configuring Application-Specific Web Services Security

Application-specific web services security functionality is configured (at application assembly) by defining message-security-binding elements in the Sun-specific deployment descriptors of the application. These message-security-binding elements are used to associate a specific provider or message protection policy with a web services endpoint or service reference, and may be qualified so that they apply to a specific port or method of the corresponding endpoint or referenced service.

For more information on defining application specific message protection policies, refer to Chapter 5, Securing Applications, in Sun GlassFish Enterprise Server v2.1.1 Developer’s Guide.