Security context token

Definitions

To better understand security tokens, the following terms are defined:

security token

A security token represents a collection of claims.

security context

A security context is an abstract concept that refers to an established authentication state and negotiated key or keys that can have additional security-related properties. A security context needs to be created and shared by the communicating parties before being used. A security context is shared among the communicating parties for the lifetime of a communications session and a security context token is the wire representation of this abstract security context.

WebSphere Application Server does not support a security context token created by one of the communicating parties and propagated with a message

WebSphere Application Server does not support creating a security context token through negotiation and exchanges.

security context token

A security context token is a wire representation of that security context abstract concept, which allows a context to be named by a URI and to be used with Web Services Security. A secured communication with a security context token between two parties is realized with WS-Trust and WS-SecureConversation.

security token service

A security token service (STS) is a web service that issues security tokens, meaning it makes assertions that are based on evidence that it trusts, to whoever trusts it (or to specific recipients).

Trust service

The trust service is the security token service and supporting code that is provided by Websphere Application Server.

RequestSecurityToken (RST)

A RST is a message sent to a security token service to request a security token.

RequestSecurityToken Response (RSTR)

A RSTR is a response to a request for a security token from a security token service to a requestor after receiving an RST message.

To communicate trust, a service requires proof, such as a signature, to prove knowledge of a security token or set of security tokens. A service itself can generate tokens or it can rely on a separate security token service to issue a security token with its own trust statement. Note that, for some security token formats, communicating trust can just be a re-issuance or a co-signature that forms the basis of trust brokering.

Syntax for the <wsc:SecurityContextToken> element

A security context is shared among the communicating parties for the lifetime of a communications session and a security context token is the wire representation of this abstract security context.

http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/sct

The syntax for <wsc:SecurityContextToken> element is as follows:

<wsc:SecurityContextToken wsu:Id="..." ...>
    <wsc:Identifier>...</wsc:Identifier>
    <wsc:Instance>...</wsc:Instance>
    ...
</wsc:SecurityContextToken>

The security context token does not support references to it by using key identifiers or key names. All references must use an ID (to a wsu:Id attribute) or use a URI reference, <wsse:Reference>, to the <wsc:Identifier> element in the security context token.