Configure the Web services client for response decryption

This task provides the steps needed to configure the client for response decryption. Use these steps to modify the extensions to indicate which parts of the response that you want to decrypt. Before configuring the client for response decryption, you must know what server parts encrypt the response. The server response encryption and client response decryption configurations must match. The steps in this task also describe how to configure the bindings to indicate how to decrypt the parts of the response.

Perform the following steps in the WebSphere Development Studio Client for iSeries to configure the parts of the SOAP response that you must decrypt:

1. Open the webservicesclient.xml file in the Web Services Client Editor of the WebSphere Development Studio Client for iSeries. For more information, see Configure your Web services application.

2. Click the Security Extensions tab.

3. Expand the Response Receiver Configuration --> Required Confidentiality settings.

4. Select the parts of the message that you must decrypt by clicking Add and selecting one of the following two message parts:

   • Bodycontent
     This is the user data portion of the message.

   • Usernametoken
     This is the basic authentication information, if selected.

   The information selected in this step is encrypted by the server in the response sender.

   Note: A username token is typically not sent in the response. Thus, you usually do not need to select Usernametoken.

5. Save the file.

Next, perform the following steps in the Web Services Client Editor to configure the information needed to decrypt the required message parts:

1. Click the Port Binding tab.

2. Expand the Security Response Receiver Binding Configuration --> Encryption Information settings. For more information on encrypting and decrypting SOAP messages, see XML encryption.

3. Click Edit to view the encryption information. The following table describes the purpose for each of this information. Some of these definitions are based on the XML-Signature Syntax and Processing specification (http://www.w3.org/TR/xmldsig-core).

   Name	Purpose
   Encryption name	The encryption name refers to the alias used for the encryption information entry.
   Data encryption method algorithm	The data encryption method algorithms are designed for encrypting and decrypting data in fixed size, multiple octet blocks.
   Key encryption method algorithm	The key encryption method algorithms are public key encryption algorithms specified for encrypting and decrypting keys.
   Encryption key name	The encryption key name represents a Subject from a certificate found by the encryption key locator. The Subject is used by the key encryption method algorithm to decrypt the secret key. The secret key is used to decrypt the data. Note: The key chosen must be a private key of the client. Encryption must be done using the public key and decryption must be done by the private key (personal certificate). For example, the personal certificate of the client is CN=Alice, O=IBM, C=US. Therefore, the client contains the public and private key pair. The target server that sends the response encrypts the secret key using the public key for CN=Alice, O=IBM, C=US. The client decrypts the secret key using the private key for CN=Alice, O=IBM, C=US.
   Encryption key locator	The encryption key locator represents a reference to a key locator implementation. For more information on configuring key locators, see Configure key locators.

4. Save the file.

Note: For decryption, the encryption key name that is chosen must refer to a personal certificate that can be located by the client key locator. The Subject (owner field of the certificate) of the personal certificate should be entered in the Encryption key name, this is typically a Distinguished Name (DN). The default key locator uses the Encryption key name to find the key within the keystore. If you write a custom key locator, the encryption key name can be anything used by the key locator to find the correct encryption key. The encryption key locator references the implementation class that locates the correct key store where this alias and certificate exists.