5.2. Configure PicketLink STS

PicketLink STS defines several interfaces that provide extension points where implementations can be plugged via configuration and the default values for some properties can be specified via configuration. All PicketLink STS configurations must be specified in the picketlink-sts.xml file. The following are the elements that can be configured in the picketlink-sts.xml file.

Note

In the following text, a service provider refers to the Web service that requires a security token to be presented by its clients.
  • PicketLinkSTS: This is the root element. It defines some properties that allows the STS administrator to set a the following default values:
    • STSName: A string representing the name of the security token service. If not specified, the default PicketLinkSTS value is used.
    • TokenTimeout: The token lifetime value in seconds. If not specified, the default value of 3600 (one hour) is used.
    • EncryptToken: A boolean specifying whether issued tokens are to be encrypted or not. The default value is false.
  • KeyProvider: This element and all its sub elements are used to configure the keystore that are used by PicketLink STS to sign and encrypt tokens. Properties like the keystore location, its password, and the signing (private key) alias and password are all configured in this section.
  • RequestHandler: This element specifies the fully qualified name of the WSTrustRequestHandler implementation to be used. If not specified, the default org.picketlink.identity.federation.core.wstrust.StandardRequestHandler is used.
  • SecurityTokenProvider: This section specifies the SecurityTokenProvider implementations that must be used to handle each type of security token. In the example we have two providers - one that handles tokens of type SpecialToken and one that handles tokens of type StandardToken. The WSTrustRequestHandler calls the getProviderForTokenType(String type)method of STSConfiguration to obtain a reference to the appropriate SecurityTokenProvider.
  • TokenTimeout: This is used by the WSTrustRequestHandler when no Lifetime has been specified in the WS-Trust request. It creates a Lifetime instance that has the current time as the creation time and expires after the specified number of seconds.
  • ServiceProviders: This section specifies the token types that must be used for each service provider (the Web service that requires a security token). When a WS-Trust request does not contain the token type, the WSTrustRequestHandler must use the service provider endpoint to find out the type of the token that must be issued.
  • EncryptToken: This is used by the WSTrustRequestHandler to decide if the issued token must be encrypted or not. If true, the public key certificate (PKC) of the service provider is used to encrypt the token.
The following is an example of PicketLink STS configuration.

Example 5.3. PicketLink STS Configuration

    <PicketLinkSTS xmlns="urn:picketlink:identity-federation:config:1.0"  
         STSName="Test STS" TokenTimeout="7200" EncryptToken="true">  
         <KeyProvider ClassName="org.picketlink.identity.federation.bindings.tomcat.KeyStoreKeyManager">  
              <Auth Key="KeyStoreURL" Value="keystore/sts_keystore.jks"/>   
                <Auth Key="KeyStorePass" Value="testpass"/>  
                <Auth Key="SigningKeyAlias" Value="sts"/>  
                <Auth Key="SigningKeyPass" Value="keypass"/>  
                <ValidatingAlias Key="http://services.testcorp.org/provider1" Value="service1"/>  
                <ValidatingAlias Key="http://services.testcorp.org/provider2" Value="service2"/>  
         </KeyProvider>  
         <RequestHandler>org.picketlink.identity.federation.core.wstrust.StandardRequestHandler</RequestHandler>  
         <TokenProviders>  
              <TokenProvider ProviderClass="org.picketlink.test.identity.federation.bindings.wstrust.SpecialTokenProvider"  
                   TokenType="http://www.tokens.org/SpecialToken"/>  
              <TokenProvider ProviderClass="org.picketlink.identity.federation.api.wstrust.plugins.saml.SAML20TokenProvider"  
                   TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>  
         </TokenProviders>  
         <ServiceProviders>  
              <ServiceProvider Endpoint="http://services.testcorp.org/provider1" TokenType="http://www.tokens.org/SpecialToken"  
                   TruststoreAlias="service1"/>  
              <ServiceProvider Endpoint="http://services.testcorp.org/provider2" TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"  
                   TruststoreAlias="service2"/>  
         </ServiceProviders>  
    </PicketLinkSTS>
Report a bug