
Administration Commands       create-message-security-provider(1)

NAME
     create-message-security-provider  -  enables  administrators
     to  create  the  message-security-config and provider-config
     sub-elements for the security service in domain.xml

SYNOPSIS
     create-message-security-provider
     [--terse={true|false}][ --echo={true|false} ]
     [ --interactive={true|false} ] [ --host  host]
     [--port port] [--secure| -s ] [ --user  admin_user]
     [--passwordfile filename] [--help]

     [ --target   target] --classname  provider_class
     [--layer   message_layer ] [--providertype provider_type ]
     [--requestauthsource  request_auth_source  ]
     [--requestauthrecipient  request_auth_recipient ]
     [--responsetauthsource  response_auth_source  ]
     [--responseauthrecipient  response_auth_recipient ]
     [--isdefaultprovider] [ --property  name=value[:name=value]*  ]
     provider_name

DESCRIPTION
     Enables the administrator to  create  the  message-security-
     config  and  provider-config  sub-elements  for the security
     service in domain.xml (the file  that  specifies  parameters
     and  properties  of  a domain). The options specified in the
     list below apply to attributes within the  message-security-
     config  and  provider-config  sub-elements of the domain.xml
     file.

     If the message-layer (message-security-config) element  does
     not exist, this command creates it, and then provider-config
     is created under it.

     This command is supported in remote mode only.

OPTIONS
     If an option has a short option name, then the short  option
     precedes  the  long option name. Short options have one dash
     whereas long options have two dashes.

     -t --terse                  Indicates that any  output  data
                                 must  be very concise, typically
                                 avoiding   human-friendly   sen-
                                 tences    and   favoring   well-
                                 formatted data  for  consumption
                                 by a script. Default is false.

Java EE 5           Last change: 13 Jul 2007                    1

Administration Commands       create-message-security-provider(1)

     -e --echo                   Setting to true  will  echo  the
                                 command  line  statement  on the
                                 standard  output.   Default   is
                                 false.

     -I --interactive            If set to true  (default),  only
                                 the  required  password  options
                                 are prompted.

     -H --host                   The  machine  name   where   the
                                 domain  administration server is
                                 running. The  default  value  is
                                 localhost.

     -p --port                   The HTTP/S port for  administra-
                                 tion.  This is the port to which
                                 you should point your browser in
                                 order  to manage the domain. For
                                 example, http://localhost:4848.

                                 The default port number is 4848.

     -s --secure                 If set to true, uses SSL/TLS  to
                                 communicate   with   the  domain
                                 administration server.

     -u --user                   The authorized  domain  adminis-
                                 tration   server  administrative
                                 username.

                                 If you have authenticated  to  a
                                 domain  using  the asadmin login
                                 command,  then  you   need   not
                                 specify  the  --user  option  on
                                 subsequent  operations  to  this
                                 particular domain.

     --passwordfile              The --passwordfile option speci-
                                 fies  the  name,  including  the
                                 full path, of a file  containing
                                 the   password   entries   in  a
                                 specific format. The  entry  for
                                 the   password   must  have  the
                                 AS_ADMIN_ prefix followed by the
                                 password   name   in   uppercase
                                 letters.

Java EE 5           Last change: 13 Jul 2007                    2

Administration Commands       create-message-security-provider(1)

                                 For  example,  to  specify   the
                                 domain   administration   server
                                 password, use an entry with  the
                                 following                format:
                                 AS_ADMIN_PASSWORD=password,
                                 where  password  is  the  actual
                                 administrator  password.   Other
                                 passwords  that can be specified
                                 include AS_ADMIN_MAPPEDPASSWORD,
                                 AS_ADMIN_USERPASSWORD,       and
                                 AS_ADMIN_ALIASPASSWORD.

                                 All remote commands must specify
                                 the  admin password to authenti-
                                 cate to the  domain  administra-
                                 tion  server,  either through --
                                 passwordfile or  asadmin  login,
                                 or  interactively on the command
                                 prompt. The asadmin  login  com-
                                 mand can be used only to specify
                                 the admin  password.  For  other
                                 passwords,  that  must be speci-
                                 fied for  remote  commands,  use
                                 the --passwordfile or enter them
                                 at the command prompt.

                                 If you have authenticated  to  a
                                 domain  using  the asadmin login
                                 command,  then  you   need   not
                                 specify   the   admin   password
                                 through    the    --passwordfile
                                 option  on subsequent operations
                                 to this particular domain.  How-
                                 ever, this is applicable only to
                                 AS_ADMIN_PASSWORD  option.   You
                                 will  still  need to provide the
                                 other  passwords,  for  example,
                                 AS_ADMIN_USERPASSWORD,   as  and
                                 when required by individual com-
                                 mands, such as update-file-user.

                                 For security reasons,  passwords
                                 specified   as   an  environment
                                 variable will  not  be  read  by
                                 asadmin.

                                 The    default     value     for
                                 AS_ADMIN_MASTERPASSWORD       is
                                 changeit.

Java EE 5           Last change: 13 Jul 2007                    3

Administration Commands       create-message-security-provider(1)

     --help                      Displays the help text  for  the
                                 command.

     --target                    This operand is valid in domains
                                 that  are  configured to support
                                 clusters, such as  domains  that
                                 are  created  with  the  cluster
                                 profile or the  enterprise  pro-
                                 file..  Specifies  the target on
                                 which you are creating the  mes-
                                 sage security provider. The fol-
                                 lowing values are valid:

                                     o    server-  Specifies  the
                                          default server instance
                                          as the target.   server
                                          is   the  name  of  the
                                          default server instance
                                          and   is   the  default
                                          value.

                                     o    domain-   Specifies   a
                                          certain  domain  as the
                                          target.

                                     o    cluster_name- Specifies
                                          a  certain  cluster  as
                                          the target.

                                     o    instance_name-   Speci-
                                          fies  a  certain server
                                          instance as the target.

OPTIONAL ATTRIBUTES
     The following optional attribute name/value pairs are avail-
     able:

     classname

         Defines the Java implementation class of  the  provider.
         Client   authentication  providers  must  implement  the
         com.sun.enterprise.      security.jauth.ClientAuthModule
         interface.  Server-side  providers  must  implement  the
         com.sun.enterprise.security       jauth.ServerAuthModule
         interface.   A  provider  may implement both interfaces,
         but it must implement the interface corresponding to its
         provider type.

Java EE 5           Last change: 13 Jul 2007                    4

Administration Commands       create-message-security-provider(1)

     layer

         The message-layer entity used to define the value of the
         auth-layer  attribute  of  message-security-config  ele-
         ments.  The default is SOAP.

     providertype
         Establishes whether the provider is to be used as client
         authentication provider, server authentication provider,
         or both. Valid options for this property include client,
         server,  or  client-server. The default value is client-
         server.

     requestauthsource

         The auth-source  attribute  defines  a  requirement  for
         message-layer sender authentication (e.g. username pass-
         word) or content authentication (e.g. digital signature)
         to  be applied to request messages.  Possible values are
         sender or content.  When this argument is not specified,
         source authentication of the request is not required.

     requestauthrecipient
         The auth-recipient attribute defines a  requirement  for
         message-layer  authentication  of the receiver of a mes-
         sage to its sender (e.g. by  XML  encryption).  Possible
         values  are before-content or after-content. The default
         value is after-content.

     responseauthsource

         The auth-source  attribute  defines  a  requirement  for
         message-layer sender authentication (e.g. username pass-
         word) or content authentication (e.g. digital signature)
         to be applied to response messages.  Possible values are
         sender or content.  When this option is  not  specified,
         source authentication of the response is not required.

     responseauthrecipient
         The auth-recipient attribute defines a  requirement  for
         message-layer  authentication  of  the  receiver  of the
         response message to its sender (e.g. by XML encryption).
         Possible values are before-content or after-content. The
         default value is after-content.

Java EE 5           Last change: 13 Jul 2007                    5

Administration Commands       create-message-security-provider(1)

     isdefaultprovider

         The default-provider attribute is used to designate  the
         provider  as  the default provider (at the layer) of the
         type or types identified by the  providertype  argument.
         There is no default associated with this option.

     property
         Use this property  to  pass  provider-specific  property
         values  to  the provider when it is initialized. Proper-
         ties passed in this way might include key aliases to  be
         used  by  the provider to get keys from keystores, sign-
         ing, canonicalization, encryption algorithms, etc.

OPERANDS
     provider_name               The name of the provider used to
                                 reference   the  provider-config
                                 element.

EXAMPLES
     Example 1 Using create-message-security-provider

     The following example shows how to create a message security
     provider for a client.

       asadmin> create-message-security-provider --user admin
       --passwordfile pwd_file
       --classname com.sun.enterprise.security.jauth.ClientAuthModule
       --providertype client mySecurityProvider

EXIT STATUS
     0                            command executed successfully

     1                            error in executing the command

SEE ALSO
     delete-message-security-provider(1),  list-message-security-
     providers(1)

Java EE 5           Last change: 13 Jul 2007                    6

