SoapUI Configuration for Messaging Encryption

SOAP Web Service Tutorials - Herong's Tutorial Examples - Version 5.02, by Dr. Herong Yang

SOAP Web Service Tutorials - Herong's Tutorial Examples

∟SoapUI Configuration for Messaging Encryption

This section provides a tutorial example on how to create a configuration entry to support SOAP messag encryption with an X.509 certificate in a JKS (Java KeyStore) file.

If you want to encrypt some parts of a SOAP message with X.509 certificates for testing purpose, you can use SoapUI.

Here is what I did to set a configuration in SoapUI to encrypt outgoing SOAP message with default options as much as possible.

1. Start SoapUI and load Hello_WSDL_11_SOAP.wsdl as shown in previous tutorials.

2. Double-click on the project name "helloProject" The project properties screen shows up.

3. Click on the "Keystores" tab.

4. Click the "+" icon to add a keystore by select "MyKeyStore.jks" file created from the previous tutorial. The key store file password needs to be entered too.

5. Click on the "WS-Security Configurations" tab.

4. On the next level tab list, click on "Outgoing WS-Security Configurations".

5. Click the "+" icon to add a WS-Security configuration. Then enter "Encryption" as the configuration name.

6. Click the "+" icon below the configuration name list to add a configuration entry, Then select "Encryption" from the entry type list.

7. Enter the following to complete the configuration entry:

Keystore: MyKeyStore.jks
ALias: mycertificate
Password: 
Key Identifier Type: Binary Security Token
Symmetric Encoding Algorithm: default
Key Encryption Algorithm: default
Create Encrypted Key: [x] Indicates whether to encrypt the symmetric
                          key into an EncryptedKey or not
Parts: None

Notes on above settings:

The "Keystore" value must specify a JKS (Java KeyStore) file.
The "Alias" value must specify a certificate entry in the specified JKS file.
The specified certificate entry must have an X.509 certificate provided by the SOAP message receiver. It binds the public key of a private-public key pair to the receiver. In this example, "mycertificate" has a self-signed X.509 certificate.
The "password" value is not needed, because no private key is needed to encrypt a SOAP message.
The public key in the X.509 certificate will be used by the send to encrypt a randomly generated secret key.
The SOAP message will be encrypted by the secret key.
The X.509 certificate will be attached to the SOAP message for the SOAP message receiver.
The receiver will find the private key matching the public key in the X.509 certificate in receiver's database.
The private key will be used to decrypt the SOAP message.

The picture belows shows you the WS-Security configuration entry to support message encryption:
SoapUI - WS-Security Encryption Configuration