Sun GlassFish Enterprise Server 2.1 Administration Guide

Configuring a JCE Provider

The Java Cryptography Extension (JCE) provider included with J2SE 1.4.x does not support RSA encryption. Because the XML Encryption defined by WS-Security is typically based on RSA encryption, in order to use WS-Security to encrypt SOAP messages you must download and install a JCE provider that supports RSA encryption.


Note –

RSA is public-key encryption technology developed by RSA Data Security, Inc. The acronym stands for Rivest, Shamir, and Adelman, the inventors of the technology.


If you are running the Enterprise Server on version 1.5 of the Java SDK, the JCE provider is already configured properly. If you are running the Enterprise Server on version 1.4.x of the Java SDK, you can add a JCE provider statically as part of your JDK environment, as follows.

  1. Download and install a JCE provider JAR (Java ARchive) file.

    The following URL provides a list of JCE providers that support RSA encryption: http://java.sun.com/products/jce/javase_providers.html.

  2. Copy the JCE provider JAR file to java-home/jre/lib/ext/.

  3. Stop the Enterprise Server.

    If the Enterprise Server is not stopped and then restarted later in this process, the JCE provider will not be recognized by the Enterprise Server.

  4. Edit the java-home/jre/lib/security/java.security properties file in any text editor. Add the JCE provider you’ve just downloaded to this file.

    The java.security file contains detailed instructions for adding this provider. Basically, you need to add a line of the following format in a location with similar properties:


    security.provider.n=provider-class-name
    

    In this example, n is the order of preference to be used by the Enterprise Server when evaluating security providers. Set n to 2 for the JCE provider you’ve just added.

    For example, if you’ve downloaded The Legion of the Bouncy Castle JCE provider, you would add this line.


    security.provider.2=org.bouncycastle.jce.provider.
       BouncyCastleProvider

    Make sure that the Sun security provider remains at the highest preference, with a value of 1.


    security.provider.1=sun.security.provider.Sun

    Adjust the levels of the other security providers downward so that there is only one security provider at each level.

    The following is an example of a java.security file that provides the necessary JCE provider and keeps the existing providers in the correct locations.


    security.provider.1=sun.security.provider.Sun
    security.provider.2=org.bouncycastle.jce.provider.
       BouncyCastleProvider
    security.provider.3=com.sun.net.ssl.internal.ssl.Provider
    security.provider.4=com.sun.rsajca.Provider
    security.provider.5=com.sun.crypto.provider.SunJCE
    security.provider.6=sun.security.jgss.SunProvider
  5. Save and close the file.

  6. Restart the Enterprise Server.