The Security token service module for Key Encryption and
Signature Service (KESS) is called the KESS STS Module.
This
module facilitates the following generic XML security operations in
an STS module:
- XML digital signing of a portion of XML
- XML signature validation of a signed portion of XML
- XML encryption of a portion of XML
- XML decryption of a portion of encrypted XML
The KESS STS module performs discretionary XML security operations
as part of message workflows. With this module, users can automatically
use the centralized key storage and hardware cryptography support.
- Scenario
The following example describes a standard scenario:
- A user previously deployed IBM® Tivoli® Federated Identity Manager for federated
single sign-on or identity mediation. The XML security keys are stored
in KESS.
- The user wants to generate or validate (or both) additional XML
security messages not natively supported by IBM Tivoli Federated Identity Manager. The user also
wants to use the stored KESS security keys for the generation or validation
(or both).
- The user writes specialized company-specific application code
to generate the XML messages.
- The user uses the IBM Tivoli Federated Identity Manager STS
and the stored keys to perform the XML security operation.
- Deployment scenarios for this module type
- Custom trust chains
- Supported modes
- Map
- Configuration properties
Use the administration console to configure an XML security
operation. The console prompts you to specify configuration properties.
The following section lists the properties that you can configure.
- Please select the operation to perform
- Specifies the configured operation for the module: sign, validate,
encrypt, or decrypt. Depending on the operation, select one operation.
- STS Universal User Attribute
- Specifies on which attribute in the STSUU AttributeList to
perform the operation. This property is common to all operations.
- Signature properties
- Provides confirmation to the receiving party that a message was
not altered during transmission. If performing the signature operation,
select from the following configuration properties.
- Select the key to use if performing signing: Generates
the XML signature with the keystore alias of the private key. Select
the alias from the available keystores.
- Include the Public Key?: Specifies whether to include the
public key in the KeyInfo.
- Include X509 Subject Issuer Details?: Specifies whether
to include issuer information in the KeyInfo/X509Data.
- Include the X509 Subject Name?: Specifies whether to include
the X509SubjectName (distinguished name of signing certificate) in
the KeyInfo/X509Data.
- Include the X509 Certificate Data?: Specifies whether to
include the X509CertificateData in the KeyInfo/X509Data.
- Include the X509 Subject Key Identifier?: Specifies whether
to include the Subject Key Identifier in the KeyInfo/X509Data.
- Use Inclusive Namespaces when signing: Specifies whether
to use the InclusiveNamespaces construct, which means
employing exclusive XML canonicalization for greater standardization.
- Validation properties
- Confirms to the receiving party that the transmitted message came
from a trusted source. If performing validation, select from the following
configuration properties.
- Validate signature on the STSUniversalUser attribute: Specifies
whether to enable signature validation.
- Use the KeyInfo of the XML to find X.509 certificate for signature
validation: Checks if the signature came from an expected key.
Selecting this flag includes specifying the Subject distinguished
name expression for the allowable X.509 certificates. Enter a regular
expression to validate the Subject distinguished name that is returned
in the KeyInfo.
- Use keystore alias to find public key for signature validation:
Specifies a key from the available keystores that can validate the
signature.
- Use Included X509 Cert Data (when validating signatures):
Specifies whether to use embedded certificate data or a KESS keystore
certificate to validate the signature. For example, the KESS keystore
might receive a message signed by a key that is not in the KESS keystore.
However, the signer of that key is in the keystore. Signature validation
might then occur with the certificate embedded in the message.
- Encryption properties
- Provides an extra layer of security for messages that have been
signed. Encryption uses the public key of the intended recipient.
If performing encryption, select from the following configuration
properties.
- Select the key to use if performing encryption: Generates
XML encryption with the keystore alias of the public key. Select the
alias from the available keystores.
- Block Encryption Algorithm (encryption only): Specifies
the block encryption algorithm. Select the identifier for one of the
following block encryption algorithms:
- Triple DES
- AES 128
- AES 192
- AES 256
- Key Transport Algorithm (encryption only): Specifies the
key transport algorithm. Select the identifier for one of the following
key transport algorithms:
- Decryption properties
- Specifies the private key for decrypting the encrypted message.
If performing decryption, select the following configuration property.
- Select the key to use if performing decryption
- Generates XML decryption with the keystore alias of the private
key. Select the alias from the available keystores.