![Close [x]](http://dw1.s81c.com/i/c.gif){kind=small}
Before you begin
Take this tutorial if you are a Web developer or architect and want to understand how to build secure Web services using Rational® Application Developer. This tutorial assumes that you have a basic knowledge of Java™ technology and Web services. It takes you through a fairly complete example of adding signatures, encryption, and a token to a Web service.
Rational Application Developer is easy to use, so you'll find this tutorial easy to follow even if you're a beginner to Web services and Java technology. In addition to showing you how to use the tools within Rational Application Developer, this tutorial gives you an introduction to Web services security and shows you what happens behind the scenes in a Web services architecture. If you are a complete newbie to Java technology, some of these concepts might be easier to follow if you have a basic understanding of Web services.
This tutorial describes the functionality available within Rational Application Developer to secure Web services. Rational Application Developer provides features with which you can apply authentication, integrity, and confidentiality to Web services.
There are various mechanisms for implementing security in a distributed system. Many of these secure the transport protocol and use a variety of other security mechanisms to achieve their objectives. The security that we will focus on in this tutorial is SOAP message security. This means that the security information is contained in and travels with each SOAP message, making it transport-independent. This security is based on:
- XML digital signatures: provides integrity
- XML encryption: provides confidentiality
- Security tokens: provides authentication
It is important to distinguish between security mechanisms that are transport dependent and those that are transport independent. Developers often strive to ensure that their services are not bound to any particular transport. If your security model is based on the transport, you are indirectly tightly coupling your service, should you need it to be secure, to a fixed protocol.
In addition, it is preferable to have security abstracted out of the service -- that is, to have it be a deployment-time option. This allows you to modify the security as and when required without changing the service. Changing your code every time you change your security policies can be very difficult, expensive, and prone to error. Having security abstracted out also allows you the option of deploying your services with or without security. Security adds processing overhead to any operation, and it should be used only when it is warranted.
To complete the steps in this tutorial, you need to install Rational Application Developer V6.0 or higher. You can download a trial copy of Rational Application Developer for WebSphere® Software V6.0 from developerWorks. The installation process is straightforward and hassle free, and you will need to complete a short registration form. WebSphere Application Server V6.0 test environment within Rational Application Developer for WebSphere Software V6.0 was used in this tutorial to test the examples. The screen captures were generated using Rational Application Developer for WebSphere Software V6.0. If you are using Rational Application Developer for WebSphere Software V6.0.1 it should still work. Some of the screens might be slightly different to the ones shown here, however the relevant fields are shown here.
You also need to download the sample code AtomicClock.java.
Table of contents
Next steps from IBM
Tags
Use the slider bar to see more or fewer tags.
Popular tags shows the top tags for this particular content zone (for example, Java technology, Linux, WebSphere).
My tags shows your tags for this particular content zone (for example, Java technology, Linux, WebSphere).
Popular tutorial tags |
My tutorial tagsSkip to tags list
Popular tutorial tags |
My tutorial tags
