IBM WebSphere V5.0 Security - CGISecurity

Enable operation-level authorizationFirst of all, make sure you have enabled Gateway-level authentication beforeenabling operation-level authorization. The operation-level authorization is onlypossible for those Web Services that are deployed onto Web Services GateWay(WSGW) with the option Authorization Policy-Control access to this serviceselected.Providing Operation-level authorization is also nothing more than extendingWebSphere security for the beans to Web Services. That is the reason whyoperation-level authentication is also called Web Service Security - Role-basedauthorization.The implementation consists of writing a wrapper enterprise bean for the actualWeb Service component, making sure that the method calls are matching. Nowimplementing WebSphere Application Server's authorization methodology intothe wrapper enterprise bean will ensure that the Web Service component isinvoked only when the caller has appropriate authorization levels. We need toprotect the service component and the enterprise bean in the .ear file and applyauthorization rules to the EAR file.The following procedure will show you how to implement operation-levelauthorization:1. Create an EAR file:a. Go to /scripts/auth folder in the command prompt.b. Run the following command:WSGWAuthGen Where the is the URL for the gateway and isthe Name of the service as deployed onto the gateway (case-sensitive).For example:WSGWAuthGen http://myserver:port_number/wsgw CalendarThe your_service.ear file should now be created in the/scripts folder.2. Assign roles to protect methods:a. In WebSphere Application Assembly Tool (AAT), select File -> Open andfind the file wsgwauth.ear file under/installableApps.b. The following steps will import the your_service.ear archive into thewsgwauth.ear archive.i. In the navigation pane, open the pop-up menu for EJB Modules andselect Import.Chapter 7. Securing Enterprise Integration components 157