Security Token Service Connector

Service provider offers Web service and uses STS
The service provider offers a service via a Web service. This Web service is secured via an STS.
A Web service request is valid only, if it contains a valid token of the STS. Each time the provider receives a request from a consumer, it first checks the token’s validity. Depending on the token type the provider checks the certificate’s validity.

Service consumer requests using service
To be able to call up the service the consumer needs the service’s interface description, the so called WSDL file. This WSDL file can be requested directly from the service provider or from a directory service. In the WSDL file the security requirements are described which the consumer must meet to be able to use the service. Amongst others, it is defined against which STS the consumer must authenticate itself.
Now, that the consumer knows the STS address, it can call up the STS and authenticate itself against it.

STS provider checks request of the service consumer The STS provider checks the consumer request on basis of the included characteristics. These may be username/ password or the certificate, the request is signed with. If the check was successful, the STS generates two tokens:

Service consumer calls up service provider
The consumer receives both tokens and extracts the session key from the test token. It creates the Web services call and signs the call using the session key. Then the consumer sends the call and the STS token to the service provider.

Service provider checks the signature of the token
The service provider checks the token’s signature with the public key of the STS to verify whether the tokens really originates from the STS. Then, the provider decrypts the token with its private key and thus obtains the session key and the information included within about the consumer’s identity.
On basis of the session keys the provider checks the Web service request’s signature. At this point in time only the STS, the consumer and the service provider know the session key, thus the service provider can assume that it is really the consumer, for whom the STS has issued the token, who has signed the service request. Now the service provider only needs to check whether the STS has integrated the required certificates into the token.

Service provider sends service response or error message
If the required certificates are integrated into the token, the service request is executed, the service response is encrypted, signed and send to the consumer.
If the certificates are missing an error is returned.

Create an STS Connector or open it for editing.

In the Secured service providers area click Add. Refer to Dialog Security Token Service - WS Trust. The following dialog opens:

In the Provider endpoint URI field, enter the URL of the Web service provider.

Click Add truststore or certificate to add the certificate of the Web service provider with the public key.

Close the dialog with OK.

In the WSDL file, enter the alias of the added Web service’s certificate. The tc.CertAlias element must be adapted.

Click Finish to store the changes.

If your web services provider was created in the INUBIT software, you need to configure its communication with the STS.