The Authentication Web Service defines how to perform authentication using SOAP. The exchange of authentication information between a web service consumer (WSC) and the web service provider (WSP) is accomplished using SOAP-bound messages. The messages are a series of client requests and server responses specific to the defined Simple Authentication and Security Layer (SASL) mechanism (or mode of authentication). After receiving a request for authentication (or any response from the WSC), the WSP may issue additional challenges, or indicate authentication failure or success. The Authentication Web Service is for service-to-service (non-user) authentication. The following steps detail the sequence between the WSC and the Authentication Web Service (a WSP).
The authentication exchange begins with a WSC sending an SASL authentication request to the Authentication Web Service on behalf of a principal.
The request message contains an identifier for the principal and indicates one or more SASL mechanisms from which the service can choose.
The Authentication Web Service responds by asserting the method to use and, if applicable, initiating a challenge.
If the Authentication Web Service does not support any of the cited methods, it responds by aborting the exchange.
The WSC responds with the necessary credentials for the chosen method of authentication.
The Authentication Web Service replies by approving or disproving the authentication.
If approved, the response includes the credentials the WSC needs to invoke other web services (like the Discovery Service).
The following Authentication Web Service global attributes can be configured for your implementation.
Challenge Cleanup Interval — This specifies cleanup interval (in seconds) in the default CRAM-MD5 mechanism handler implementation class com.sun.identity.liberty.ws.authnsvc.mechanism.CramMD5MechanismHandler. The internal thread will start to cleanup the challenge map based on this value.
Transform Classes — This specifies the transform name to the implementation class mapping. Values are comma separated with "|" as delimiter for the transform name and implementation class name. For example, name1|class1, name2|class2.
The following task is associated with configuring the Authentication Web Service: