Contents
This filter enables the API Gateway to verify XML Signatures as a service according to the OASIS Digital Signature Services (DSS) specification. The DSS specification describes how a client can send a message containing an XML Signature to a DSS Signature verification Web Service that can verify the Signature and return the result of the verification to the client.
The advantage of this approach is that the Signature verification code is abstracted from the logic of the Web Service and does not have to be coded into the Web Service. Furthermore, in a Services Oriented Architecture (SOA), a centralized DSS server provides a single implementation point for all XML Signature related services, which can then be accessed by all Services running in the SOA. This represents a much more manageable solution that one in which the security layer is coded into each Web Service.
Complete the following fields to configure the Verify Signature Web Service filter.
Name:
Enter a descriptive name for the filter.
Find Signing Key:
The public key to be used to verify the signature can be retrieved from one of the following locations:
-
Via KeyInfo in Message:
The verification certificate can be located using the
<KeyInfo>block in the XML Signature. For example, the certificate could be contained in a<BinarySecurityToken>element in a WSSE Security header. The<KeyInfo>section of the XML Signature can then reference thisBinarySecurityToken. The API Gateway can automatically resolve this reference to locate the certificate that contains the public key necessary to perform the signature verification. -
Via Selector Expression:
The certificate used to verify the signature can be extracted from the message attribute specified in the selector expression (for example,
${certificate}). The certificate must have been placed into the specified attribute by a predecessor of the Verify Signature Web Service filter. For more details on selector expressions, see Selecting Configuration Values at Runtime. -
Via Certificate in LDAP:
The certificate used to verify the Signature can be retrieved from an LDAP directory. Click the button next to this field, and select a previously configured LDAP directory in the tree. To add an LDAP directory, right-click the LDAP Connections tree node, and select Add an LDAP Connection. Alternatively, you can configure LDAP Connections under the External Connections node in the Policy Studio tree. For more details, see the topic on Configuring LDAP Directories.
-
Via Certificate in Store:
Finally, the verification certificate can be selected from the Certificate Store. Click the Select button to view the certificate that has been added to the store. Select the verification certificate by selecting the checkbox next to it in the table.
