Lightweight Third-Party Authentication (LTPA) is a type of authentication
mechanism in WebSphere Application Server security that defines a particular
token format. The purpose of the LTPA token authentication is to flow the
LTPA token from the first Web service, which authenticated the originating
client, to the downstream Web service. You can configure the server for LTPA
token authentication.
About this task
Important: There is an important distinction between
Version 5.x and Version 6.0.x and later applications. The information
in this article supports Version 5.x applications only that are used
with WebSphere Application Server Version 6.0.x and later. The information
does not apply to Version 6.0.x and later applications.
This
task is used to configure LTPA. Do not attempt to configure LTPA from a pure
client. After the downstream Web service receives the LTPA token, it validates
the token to verify that the token has not been modified and has not expired.
For validation to be successful, the LTPA keys that are used by both the sending
and receiving servers must be the same.
Complete the following steps
to specify that LTPA is the authentication method. The authentication method
indicated in these steps must match the authentication method that is specified
for the client.
Procedure
- Launch an assembly tool. For more information on the
assembly tools, see Assembly tools
.
- Switch to the Java 2 Platform, Enterprise Edition (J2EE) perspective.
Click Window > Open Perspective > J2EE.
- Click EJB Projects > application_name > ejbModule
> META-INF.
- Right-click the webservices.xml file, and click Open
with > Web services editor.
- Click the Extensions tab, which is located at the bottom of the
Web services editor within the assembly tool.
- Expand the Request receiver service configuration details >
Login configuration section. You can select from the following
options:
- BasicAuth
- Signature
- ID assertion
- LTPA
- Select LTPA to authenticate the client using the LTPA token
received from the request.