You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by bu...@apache.org on 2021/12/22 21:03:41 UTC
svn commit: r1077671 [18/44] - in /websites/production/cxf/content: ./ cache/ docs/ docs/custom-transport.data/ docs/how-it-works.data/ docs/ws-policy.data/ docs/xml-key-management-service-xkms.data/
Modified: websites/production/cxf/content/docs/jax-rs-http-signature.html
==============================================================================
--- websites/production/cxf/content/docs/jax-rs-http-signature.html (original)
+++ websites/production/cxf/content/docs/jax-rs-http-signature.html Wed Dec 22 21:03:39 2021
@@ -59,11 +59,7 @@ Apache CXF -- JAX-RS HTTP Signature
<td id="cell-1-1"> </td>
<td id="cell-1-2">
<!-- Banner -->
-<div class="banner" id="banner"><div><table border="0" cellpadding="0" cellspacing="0" width="100%"><tr><td align="left" colspan="1" nowrap>
-<a shape="rect" href="http://cxf.apache.org/" title="Apache CXF"><span style="font-weight: bold; font-size: 170%; color: white">Apache CXF</span></a>
-</td><td align="right" colspan="1" nowrap>
-<a shape="rect" href="http://www.apache.org/" title="The Apache Sofware Foundation"><img border="0" alt="ASF Logo" src="http://cxf.apache.org/images/asf-logo.png"></a>
-</td></tr></table></div></div>
+<div class="banner" id="banner"><img class="wysiwyg-unknown-macro" src="https://cwiki.apache.org/confluence/plugins/servlet/confluence/placeholder/unknown-macro?name=html&locale=en_GB&version=2"></div>
<!-- Banner -->
<div id="top-menu">
<table border="0" cellpadding="1" cellspacing="0" width="100%">
@@ -100,7 +96,7 @@ Apache CXF -- JAX-RS HTTP Signature
<div id="wrapper-menu-page-bottom">
<div id="menu-page">
<!-- NavigationBar -->
-<div id="navigation"><ul class="alternate"><li><a shape="rect" href="overview.html">Overview</a></li><li><a shape="rect" href="how-tos.html">How-Tos</a></li><li><a shape="rect" href="frontends.html">Frontends</a></li><li><a shape="rect" href="databindings.html">DataBindings</a></li><li><a shape="rect" href="transports.html">Transports</a></li><li><a shape="rect" href="configuration.html">Configuration</a></li><li><a shape="rect" href="debugging-and-logging.html">Debugging and Logging</a></li><li><a shape="rect" href="tools.html">Tools</a></li><li><a shape="rect" href="restful-services.html">RESTful Services</a></li><li><a shape="rect" href="wsdl-bindings.html">WSDL Bindings</a></li><li><a shape="rect" href="service-routing.html">Service Routing</a></li><li><a shape="rect" href="dynamic-languages.html">Dynamic Languages</a></li><li><a shape="rect" href="ws-support.html">WS-* Support</a></li><li><a shape="rect" href="advanced-integration.html">Advanced Integration</a></li><li><a shape
="rect" href="deployment.html">Deployment</a></li><li><a shape="rect" href="schemas-and-namespaces.html">Use of Schemas and Namespaces</a></li></ul><hr><ul class="alternate"><li><p>Search</p></li></ul><div class="aui-message aui-message-error"><p class="title"><strong>Error rendering macro 'html'</strong></p><p>Your Confluence administrator has disallowed the use of Javascript in the HTML macro. This setting can be changed using HTML for Confluence Configuration. Please see your administrator for details.</p></div><hr><ul class="alternate"><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest/">API 3.2.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-3.1.x/">API 3.1.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/">CXF Website</a></li></ul><p> </p><p><a shape="rect" class="external-link" href="http://www.apache.org/events/current-event.html"><span class="confluence-embedded-file-wrapper"><img class="confluence-em
bedded-image confluence-external-resource" src="http://www.apache.org/events/current-event-125x125.png" data-image-src="http://www.apache.org/events/current-event-125x125.png"></span></a></p></div>
+<div id="navigation"><ul class="alternate"><li><a shape="rect" href="overview.html">Overview</a></li><li><a shape="rect" href="how-tos.html">How-Tos</a></li><li><a shape="rect" href="frontends.html">Frontends</a></li><li><a shape="rect" href="databindings.html">DataBindings</a></li><li><a shape="rect" href="transports.html">Transports</a></li><li><a shape="rect" href="configuration.html">Configuration</a></li><li><a shape="rect" href="debugging-and-logging.html">Debugging and Logging</a></li><li><a shape="rect" href="tools.html">Tools</a></li><li><a shape="rect" href="restful-services.html">RESTful Services</a></li><li><a shape="rect" href="wsdl-bindings.html">WSDL Bindings</a></li><li><a shape="rect" href="service-routing.html">Service Routing</a></li><li><a shape="rect" href="dynamic-languages.html">Dynamic Languages</a></li><li><a shape="rect" href="ws-support.html">WS-* Support</a></li><li><a shape="rect" href="advanced-integration.html">Advanced Integration</a></li><li><a shape
="rect" href="deployment.html">Deployment</a></li><li><a shape="rect" href="schemas-and-namespaces.html">Use of Schemas and Namespaces</a></li></ul><hr><ul class="alternate"><li><p>Search</p></li></ul><p><img class="wysiwyg-unknown-macro" src="https://cwiki.apache.org/confluence/plugins/servlet/confluence/placeholder/unknown-macro?name=html&locale=en_GB&version=2"></p><hr><ul class="alternate"><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-3.5.x/">API 3.5.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-3.2.x/">API 3.2.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-3.1.x/">API 3.1.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/">CXF Website</a></li></ul><p><br clear="none"></p><p><a shape="rect" class="external-link" href="http://www.apache.org/events/current-event.html"><span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image confluence-exte
rnal-resource" src="http://www.apache.org/events/current-event-125x125.png" data-image-src="http://www.apache.org/events/current-event-125x125.png"></span></a></p></div>
<!-- NavigationBar -->
</div>
</div>
@@ -111,22 +107,22 @@ Apache CXF -- JAX-RS HTTP Signature
<!-- Content -->
<div class="wiki-content">
<div id="ConfluenceContent"><p><style type="text/css">/*<![CDATA[*/
-div.rbtoc1556556971237 {padding: 0px;}
-div.rbtoc1556556971237 ul {list-style: disc;margin-left: 0px;}
-div.rbtoc1556556971237 li {margin-left: 0px;padding-left: 0px;}
+div.rbtoc1640206702846 {padding: 0px;}
+div.rbtoc1640206702846 ul {list-style: disc;margin-left: 0px;}
+div.rbtoc1640206702846 li {margin-left: 0px;padding-left: 0px;}
-/*]]>*/</style></p><div class="toc-macro rbtoc1556556971237">
-<ul class="toc-indentation"><li><a shape="rect" href="#JAX-RSHTTPSignature-Introduction">Introduction</a></li><li><a shape="rect" href="#JAX-RSHTTPSignature-MavenDependencies">Maven Dependencies</a></li><li><a shape="rect" href="#JAX-RSHTTPSignature-Configuration">Configuration</a>
-<ul class="toc-indentation"><li><a shape="rect" href="#JAX-RSHTTPSignature-Providers">Providers</a></li><li><a shape="rect" href="#JAX-RSHTTPSignature-FinegrainedConfiguration">Fine grained Configuration</a></li><li><a shape="rect" href="#JAX-RSHTTPSignature-ConfigurationProperties">Configuration Properties</a></li></ul>
+/*]]>*/</style></p><div class="toc-macro rbtoc1640206702846">
+<ul class="toc-indentation"><li><a shape="rect" href="#JAXRSHTTPSignature-Introduction">Introduction</a></li><li><a shape="rect" href="#JAXRSHTTPSignature-MavenDependencies">Maven Dependencies</a></li><li><a shape="rect" href="#JAXRSHTTPSignature-Configuration">Configuration</a>
+<ul class="toc-indentation"><li><a shape="rect" href="#JAXRSHTTPSignature-Providers">Providers</a></li><li><a shape="rect" href="#JAXRSHTTPSignature-FinegrainedConfiguration">Fine grained Configuration</a></li><li><a shape="rect" href="#JAXRSHTTPSignature-ConfigurationProperties">Configuration Properties</a></li></ul>
</li></ul>
-</div><h1 id="JAX-RSHTTPSignature-Introduction">Introduction</h1><p>CXF adds support for the <a shape="rect" class="external-link" href="https://tools.ietf.org/html/draft-cavage-http-signatures-10" rel="nofollow">HTTP Signatures</a> draft spec since CXF 3.3.0. This provides an alternative to providing message integrity other than <a shape="rect" href="jax-rs-xml-security.html">XML Security</a> and <a shape="rect" href="jax-rs-jose.html">JOSE</a>, and in fact provides a stronger measure of message integrity as it allows the incorporation of HTTP headers in the signature, including the HTTP method and path.</p><h1 id="JAX-RSHTTPSignature-MavenDependencies">Maven Dependencies</h1><p>The following dependency is required to use CXF's HTTP Signature implementation.</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div><h1 id="JAXRSHTTPSignature-Introduction">Introduction</h1><p>CXF adds support for the <a shape="rect" class="external-link" href="https://tools.ietf.org/html/draft-cavage-http-signatures-10" rel="nofollow">HTTP Signatures</a> draft spec since CXF 3.3.0. This provides an alternative to providing message integrity other than <a shape="rect" href="jax-rs-xml-security.html">XML Security</a> and <a shape="rect" href="jax-rs-jose.html">JOSE</a>, and in fact provides a stronger measure of message integrity as it allows the incorporation of HTTP headers in the signature, including the HTTP method and path.</p><h1 id="JAXRSHTTPSignature-MavenDependencies">Maven Dependencies</h1><p>The following dependency is required to use CXF's HTTP Signature implementation.</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
<pre class="brush: java; gutter: false; theme: Default"><dependency>
<groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-rs-security-http-signature</artifactId>
<version>3.3.2</version>
</dependency>
</pre>
-</div></div><h1 id="JAX-RSHTTPSignature-Configuration">Configuration</h1><p>CXF supports HTTP Signature creation and verification on both the client and service side. Payload integrity is supported by digesting the payload and inserting the result into a "Digest" header, which is also signed by HTTP Signature.</p><h2 id="JAX-RSHTTPSignature-Providers">Providers</h2><p>To enable HTTP Signature in CXF, it is necessary to add one of the following providers to the client or endpoint:</p><ul><li>Client / Service Outbound Signature Creation: org.apache.cxf.rs.security.httpsignature.filters.CreateSignatureInterceptor</li><li>Client Inbound Signature Verification: org.apache.cxf.rs.security.httpsignature.filters.VerifySignatureClientFilter</li><li>Service Inbound Signature Verification: org.apache.cxf.rs.security.httpsignature.filters.VerifySignatureFilter</li></ul><p>For example in code:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style
="border-bottom-width: 1px;"><b>WebClient Config</b></div><div class="codeContent panelContent pdl">
+</div></div><h1 id="JAXRSHTTPSignature-Configuration">Configuration</h1><p>CXF supports HTTP Signature creation and verification on both the client and service side. Payload integrity is supported by digesting the payload and inserting the result into a "Digest" header, which is also signed by HTTP Signature.</p><h2 id="JAXRSHTTPSignature-Providers">Providers</h2><p>To enable HTTP Signature in CXF, it is necessary to add one of the following providers to the client or endpoint:</p><ul><li>Client / Service Outbound Signature Creation: org.apache.cxf.rs.security.httpsignature.filters.CreateSignatureInterceptor</li><li>Client Inbound Signature Verification: org.apache.cxf.rs.security.httpsignature.filters.VerifySignatureClientFilter</li><li>Service Inbound Signature Verification: org.apache.cxf.rs.security.httpsignature.filters.VerifySignatureFilter</li></ul><p>For example in code:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="
border-bottom-width: 1px;"><b>WebClient Config</b></div><div class="codeContent panelContent pdl">
<pre class="brush: java; gutter: false; theme: Default">CreateSignatureInterceptor signatureFilter = new CreateSignatureInterceptor();
String address = "http://localhost:" + PORT + "/httpsig/bookstore/books";
@@ -145,7 +141,7 @@ WebClient client =
<ref bean="httpSignatureVerifier"/>
</jaxrs:providers>
</jaxrs:server></pre>
-</div></div><h2 id="JAX-RSHTTPSignature-FinegrainedConfiguration">Fine grained Configuration</h2><p>As well as adding the desired providers (see above), we need to configure them (for example the keys to use, the headers to sign, etc.). There are two options for doing this. In this section we'll look at configuring the providers directly, which allows for a more fine-grained configuration. See below for an alternative using configuration properties that retrieves keys from keystores.</p><p>For outbound signature we need to configure the CreateSignatureInterceptor provider with a MessageSigner instance. The MessageSigner contains a number of different constructors that can be used depending on the desired functionality. At a minimum, we need to supply the PrivateKey instance to sign the message, as well as the "Key Id" as defined in the spec. We can also supply the signature algorithm name - if not specified this defaults to "rsa-sha256". Similarly we can supply the security provider
name, which defaults to "SunRsaSign".</p><p>We can also supply a list of HTTP headers to sign. By default it signs all of the HTTP headers that are made available to it by CXF. On the client side it will also sign the HTTP method and Path via "(request-target)".</p><p>Here is an example from the tests:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><h2 id="JAXRSHTTPSignature-FinegrainedConfiguration">Fine grained Configuration</h2><p>As well as adding the desired providers (see above), we need to configure them (for example the keys to use, the headers to sign, etc.). There are two options for doing this. In this section we'll look at configuring the providers directly, which allows for a more fine-grained configuration. See below for an alternative using configuration properties that retrieves keys from keystores.</p><p>For outbound signature we need to configure the CreateSignatureInterceptor provider with a MessageSigner instance. The MessageSigner contains a number of different constructors that can be used depending on the desired functionality. At a minimum, we need to supply the PrivateKey instance to sign the message, as well as the "Key Id" as defined in the spec. We can also supply the signature algorithm name - if not specified this defaults to "rsa-sha256". Similarly we can supply the security provider
name, which defaults to "SunRsaSign".</p><p>We can also supply a list of HTTP headers to sign. By default it signs all of the HTTP headers that are made available to it by CXF. On the client side it will also sign the HTTP method and Path via "(request-target)".</p><p>Here is an example from the tests:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
<pre class="brush: java; gutter: false; theme: Default">CreateSignatureInterceptor signatureFilter = new CreateSignatureInterceptor();
KeyStore keyStore = KeyStore.getInstance("JKS");
keyStore.load(ClassLoaderUtils.getResourceAsStream("keys/alice.jks", this.getClass()),
@@ -186,7 +182,7 @@ client.type("application/xml").accept("a
<ref bean="httpSignatureVerifier"/>
</jaxrs:providers>
</jaxrs:server></pre>
-</div></div><h2 id="JAX-RSHTTPSignature-ConfigurationProperties">Configuration Properties</h2><p>An alternative to configure the MessageSigner, MessageVerifier instances as documented in the previous section is to use the following security configuration properties instead. These properties rely on obtaining the private keys to sign the messages, as well as the public keys used to verify the messages, from a keystore stored in the local filesystem. Note that the "Key Id" is ignored, we verify the message using the public key defined in the configuration properties.</p><p>The following configuration properties can be used to configure HTTP Signature with the various filters. Note that they are shared for the most part with <a shape="rect" href="jax-rs-jose.html">JAX-RS JOSE</a>.</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1"><col span="1"><col span="1"><col span="1"></colgroup><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh">Configurat
ion Tag</th><th colspan="1" rowspan="1" class="confluenceTh">Default</th><th colspan="1" rowspan="1" class="confluenceTh">Description</th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.keystore</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The Java KeyStore Object to use. This configuration tag is used if you want to pass the KeyStore Object through dynamically.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>rs.security.keystore.type</p></td><td colspan="1" rowspan="1" class="confluenceTd">JKS</td><td colspan="1" rowspan="1" class="confluenceTd"><p>The keystore type.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.keystore.password</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The password required to access the keystore.</td></tr><tr><td colspan="1" rowspan="
1" class="confluenceTd">rs.security.keystore.alias</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd"> The keystore alias corresponding to the key to use.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.keystore.file</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The path to the keystore file.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.key.password</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The password required to access the private key (in the keystore).</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.key.password.provider</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">A reference to a Privat
eKeyPasswordProvider instance used to retrieve passwords to access keys.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.out.properties</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The signature properties file for Compact or JSON signature creation. If not specified then it falls back to "rs.security.signature.properties".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.in.properties</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The signature properties file for Compact or JSON signature verification. If not specified then it falls back to "rs.security.signature.properties".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.properties</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><
td colspan="1" rowspan="1" class="confluenceTd">The signature properties file for Compact or JSON signature creation/verification.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.algorithm</td><td colspan="1" rowspan="1" class="confluenceTd">rsa-sha256</td><td colspan="1" rowspan="1" class="confluenceTd">The signature algorithm to use.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.http.signature.key.id</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The signature key id. This is a required configuration option on the outbound side.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.http.signature.out.headers</td><td colspan="1" rowspan="1" class="confluenceTd">all headers incl "(request-target)"</td><td colspan="1" rowspan="1" class="confluenceTd"><p>A list of String values which correspond to the list of HTTP headers that
will be signed in the outbound request.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.http.signature.in.headers</td><td colspan="1" rowspan="1" class="confluenceTd">"digest", and "(request-target)" for a client request.</td><td colspan="1" rowspan="1" class="confluenceTd"><p>A list of String values which correspond to the list of HTTP headers that must be signed in the inbound request. By default, a client request must sign "(request-target)". In addition, a client request must sign "digest", unless it is a GET/HEAD request. A service response must sign "digest" for all "OK" status codes, apart from 204.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><span class="blob-code-inner"><span class="pl-s">rs.security.http.signature.digest.algorithm</span></span></td><td colspan="1" rowspan="1" class="confluenceTd">SHA-256</td><td colspan="1" rowspan="1" class="confluenceTd"><span class="blob-code-inner"><span class="pl-c">The digest algor
ithm to use when digesting the payload.<br clear="none"></span></span></td></tr></tbody></table></div><p>Here is a Java example:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><h2 id="JAXRSHTTPSignature-ConfigurationProperties">Configuration Properties</h2><p>An alternative to configure the MessageSigner, MessageVerifier instances as documented in the previous section is to use the following security configuration properties instead. These properties rely on obtaining the private keys to sign the messages, as well as the public keys used to verify the messages, from a keystore stored in the local filesystem. Note that the "Key Id" is ignored, we verify the message using the public key defined in the configuration properties.</p><p>The following configuration properties can be used to configure HTTP Signature with the various filters. Note that they are shared for the most part with <a shape="rect" href="jax-rs-jose.html">JAX-RS JOSE</a>.</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1"><col span="1"><col span="1"><col span="1"></colgroup><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh">Configurati
on Tag</th><th colspan="1" rowspan="1" class="confluenceTh">Default</th><th colspan="1" rowspan="1" class="confluenceTh">Description</th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.keystore</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The Java KeyStore Object to use. This configuration tag is used if you want to pass the KeyStore Object through dynamically.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>rs.security.keystore.type</p></td><td colspan="1" rowspan="1" class="confluenceTd">JKS</td><td colspan="1" rowspan="1" class="confluenceTd"><p>The keystore type.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.keystore.password</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The password required to access the keystore.</td></tr><tr><td colspan="1" rowspan="1
" class="confluenceTd">rs.security.keystore.alias</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd"> The keystore alias corresponding to the key to use.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.keystore.file</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The path to the keystore file.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.key.password</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The password required to access the private key (in the keystore).</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.key.password.provider</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">A reference to a Private
KeyPasswordProvider instance used to retrieve passwords to access keys.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.out.properties</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The signature properties file for Compact or JSON signature creation. If not specified then it falls back to "rs.security.signature.properties".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.in.properties</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The signature properties file for Compact or JSON signature verification. If not specified then it falls back to "rs.security.signature.properties".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.properties</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><t
d colspan="1" rowspan="1" class="confluenceTd">The signature properties file for Compact or JSON signature creation/verification.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.signature.algorithm</td><td colspan="1" rowspan="1" class="confluenceTd">rsa-sha256</td><td colspan="1" rowspan="1" class="confluenceTd">The signature algorithm to use.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.http.signature.key.id</td><td colspan="1" rowspan="1" class="confluenceTd"><br clear="none"></td><td colspan="1" rowspan="1" class="confluenceTd">The signature key id. This is a required configuration option on the outbound side.</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.http.signature.out.headers</td><td colspan="1" rowspan="1" class="confluenceTd">all headers incl "(request-target)"</td><td colspan="1" rowspan="1" class="confluenceTd"><p>A list of String values which correspond to the list of HTTP headers that
will be signed in the outbound request.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">rs.security.http.signature.in.headers</td><td colspan="1" rowspan="1" class="confluenceTd">"digest", and "(request-target)" for a client request.</td><td colspan="1" rowspan="1" class="confluenceTd"><p>A list of String values which correspond to the list of HTTP headers that must be signed in the inbound request. By default, a client request must sign "(request-target)". In addition, a client request must sign "digest", unless it is a GET/HEAD request. A service response must sign "digest" for all "OK" status codes, apart from 204.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><span class="blob-code-inner"><span class="pl-s">rs.security.http.signature.digest.algorithm</span></span></td><td colspan="1" rowspan="1" class="confluenceTd">SHA-256</td><td colspan="1" rowspan="1" class="confluenceTd"><span class="blob-code-inner"><span class="pl-c">The digest algori
thm to use when digesting the payload.<br clear="none"></span></span></td></tr></tbody></table></div><p>Here is a Java example:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
<pre class="brush: java; gutter: false; theme: Default">List<Object> providers = new ArrayList<>();
providers.add(new CreateSignatureInterceptor());
providers.add(new VerifySignatureClientFilter());