Show Table of Contents
Chapter 5. PicketLink Identity Management
5.1. About Security Token Service (STS)
The Security Token Service generates and manages the security tokens. It does not issue tokens of a specific type. Instead, it defines generic interfaces that allows multiple token providers to be plugged in. As a result, it can be configured to deal with various types of token, as long as a token provider exists for each token type. It also specifies the format of the security token request and response messages.
A security token request message specifies the following:
- Type of the request, such as Issue, Renew, and so on.
- Type of the token.
- Lifetime of the issued token.
- Information about the service provider that requested the token.
- Information used to encrypt the generated token.
The token request message is sent in the body of the SOAP message. All information related to the token request is enclosed in the
RequestSecurityToken element. The sample request contains two other WS-Trust elements: RequestType, which specifies that this request is an Issue request, and TokenType, which specifies the type of the token to be issued.
The following is an example of the WS-Trust request message.
Example 5.1. WS-Trust security token request message
<S11:Envelope xmlns:S11=".." xmlns:wsu=".." xmlns:wst="..">
<S11:Header>
...
</S11:Header>
<S11:Body wsu:Id="body">
<wst:RequestSecurityToken Context="context">
<wst:TokenType>http://www.tokens.org/SpecialToken</wst:TokenType>
<wst:RequestType>
http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
</wst:RequestType>
</wst:RequestSecurityToken>
</S11:Body>
</S11:Envelope>
The following is an example of a security token response.
Example 5.2. Security token response message
<wst:RequestSecurityTokenResponse Context="context" xmlns:wst=".." xmlns:wsu="..">
<wst:TokenType>http://www.tokens.org/SpecialToken</wst:TokenType>
<wst:RequestedSecurityToken>
<token:SpecialToken xmlns:token="...">
ARhjefhE2FEjneovi&@FHfeoveq3
</token:SpecialToken>
</wst:RequestedSecurityToken>
<wst:Lifetime>
<wsu:Created>...</wsu:Created>
<wsu:Expires>...</wsu:Expires>
</wst:Lifetime>
</wst:RequestSecurityTokenResponse>
In the example for the security token response, the
TokenType element specifies the type of the issued token, while the RequestedSecurityToken element contains the token itself. The format of the token depends on the type of the token. The Lifetime element specifies when the token was created and when it expires.
Security Token Request Processing
The following are the steps in which the security token requests are processed:
- A client sends a security token request to
PicketLinkSTS.
PicketLinkSTSparses the request message, generating a JAXB object model.
PicketLinkSTSreads the configuration file and creates theSTSConfigurationobject, if needed. Then it obtains a reference to theWSTrustRequestHandlerfrom the configuration and delegates the request processing to the handler instance.
- The request handler uses the
STSConfigurationto set default values when needed (for example, when the request doesn't specify a token lifetime value).
- The
WSTrustRequestHandlercreates theWSTrustRequestContext, setting theJAXBrequest object and the caller principal it received fromPicketLinkSTS.
- The
WSTrustRequestHandleruses theSTSConfigurationto get theSecurityTokenProviderthat must be used to process the request based on the type of the token that is being requested. Then it invokes the provider, passing the constructedWSTrustRequestContextas a parameter.
- The
SecurityTokenProviderinstance process the token request and stores the issued token in the request context.
- The
WSTrustRequestHandlerobtains the token from the context, encrypts it if needed, and constructs the WS-Trust response object containing the security token.
PicketLinkSTSdictates the response generated by the request handler and returns it to the client.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.