Before you start

About this tutorial series

This two-part tutorial demonstrates the use of Java Messaging Service (JMS) for secure XML messaging in enterprise applications. JMS is a Java-based messaging API developed under the Java Community Process (JCP) against Java Specification Request (JSR) number 914 (see Resources).

The focus of this tutorial is to demonstrate, step-by-step, how to extend JMS functionality to incorporate support for authoring and processing secure XML messages. While doing this, I will explain and demonstrate the following:

1. The architecture of JMS
2. How client applications use JMS functionality
3. How to extend JMS functionality to include the authoring and processing of secure XML messages
4. How to use X.509 certificates for security in XML messages
5. How to use a random number as an encryption key in XML messages
6. How to use XML Security Suite for Java (XSS4J) from IBM alphaWorks to author and process secure XML documents
7. How to integrate XSS4J into a JMS application for secure XML messaging
8. How to develop a sample JMS-based messaging application that uses the security features of XSS4J

Back to top

About this tutorial

This first tutorial covers the first five of the eight points listed above. Part 1 covers everything mentioned above except XSS4J, which I will explore in Part 2.

Back to top

Prerequisites

This tutorial is aimed at Java programmers, so you should have a solid understanding of the Java language. (For more background on this topic, visit the developerworks New to Java technology page.) Specific knowledge of JMS is not necessary but helpful.

You also need to understand XML at least to the extent of being able to manually read and write XML files. (Visit the developerWorks New to XML page for more background.) You need to know how the Document Object Model (DOM) works only if you wish to change the code in this tutorial to suit your own applications. However, if you just wish to understand the material in this tutorial, you don't need to know DOM.

It is helpful (but not necessary) for you to be familiar with basic concepts of security, such as private and public keys, signatures, and encryption.

Back to top

Should I take this tutorial?

This tutorial does not discuss all the details of how to use JMS for normal enterprise messaging. If you wish to learn how to use JMS, you can refer to the following IBM developerWorks resources:

• "Introducing the Java Message Service" (June 2004)
• " JMS, XML, and the heterogeneous enterprise" (April 2000)
• " JMS 1.1 simplifies messaging with unified domains" (August 2002)

Back to top

Tutorial topics

Part 1 is divided into the following sections:

1. Tutorial introduction.
2. An enterprise message exchange scenario that establishes the need for secure XML messaging. This section also introduces the JMS architecture.
3. Demonstration of how clients use JMS functionality.
4. Strategy for incorporating XML authoring and processing capability into JMS. This section also demonstrates how to implement this strategy. At the end of this section, you will have a running XML-JMS application, which is not yet secure.
5. Discussion of XML digital signatures and an explanation of how the message exchange scenario (from the second section) uses digital signatures for authentication.
6. Discussion of XML encryption that shows how to incorporate confidentiality into XML messaging between the different departments of an enterprise.
7. Summary of the discussion which includes a brief introduction to Part 2.

Back to top

Code samples and installation requirements

The code for this tutorial works with any JMS 1.1-compliant implementation. I have listed several JMS implementations in Resources, which you can download and try.

I ran the code in this tutorial with the following JMS implementations:

• The reference implementation that comes with Java 2 Enterprise Edition Software Development Kit (J2EE SDK) version 1.4.1 from Sun. You can download J2EE SDK from the J2EE Web site.
• OpenJMS, an open source JMS implementation, which you can download from the OpenJMS Web site.

For any JMS implementation to work, you need to have the Java Development Kit (JDK) installed in your computer. I tried the samples of this tutorial with JDK version 1.4.2, which you can download from Sun's Web site (see Resources).

1 of 10 | Next

Comments

Back to top

Table of contents

• Before you start
• Why do you need secure XML messaging in enterprise applications?
• How client applications use JMS functionality
• Extending JMS to include XML messaging support
• Signing XML messages
• Adding confidentiality to XML messages
• Wrap-up
• Download
• Resources
• About the author

---

1 of 10 | Next

Local resources

• IBM Innovation Center - Austin, TX
• IBM Innovation Center - Chicago, IL
• IBM Innovation Center - Dallas, TX
• IBM Innovation Center - San Mateo, CA
• IBM Innovation Center - Waltham, MA
• Technical Briefings in North America

Dig deeper into XML on developerWorks

Try IBM PureSystems. No charge.

Experience today!

---

Get started with the cloud-based trial and pattern development kit.