Lightweight Third-Party Authentication
(LTPA) is a type
of authentication mechanism in WebSphere® Application
Server security that defines a particular token format. The purpose
of the LTPA token authentication is to flow the LTPA token from the
first web service, which authenticated the originating client, to
the downstream web service. You can configure the server to validate
LTPA token authentication.
About this task
Important: There
is an important distinction
between Version 5.x and Version 6.0.x and later applications.
The information in this article supports Version 5.x applications
only that are used with WebSphere Application Server
Version 6.0.x and later. The information does not apply to
Version 6.0.x and later applications.
This
task is used to configure LTPA. Do not attempt to configure LTPA from
a pure client. After the downstream web service receives the LTPA
token, it validates the token to verify that the token has not been
modified and has not expired. For validation to be successful, the
LTPA keys used by both the sending and receiving servers must be the
same.
Complete the following steps to specify how the server
must validate the LTPA token authentication information:
Procedure
- Launch an assembly tool. For more information,
see the related information on Assembly Tools.
- Switch
to the Java 2
Platform, Enterprise Edition (J2EE) perspective. Click .
- Click .
- Right-click the webservices.xml file,
and click .
- Click
the Binding Configurations tab, which is located
at the bottom of the web services editor within the assembly tool.
- Expand the section.
- Click Edit to
view the login mapping
information. The login mapping information is displayed.
Select or enter the following information:
- Authentication
method
- Specifies the type of authentication that occurs. Select LTPA to
use LTPA token authentication.
- Configuration
name
- Specifies the Java Authentication
and Authorization
Service (JAAS) login configuration name. For the LTPA authentication
method, enter WSLogin for the JAAS login configuration
name. This configuration understands how to validate an LTPA token.
- Use token value type
- Determines if
you want to specify a custom token type. For LTPA
authentication, you must select this option because LTPA is considered
a custom type. LTPA is not in the Web Services Security Specification.
- Token value type URI and local name
- Specifies
custom authentication types. If you select Use
Token value type you must enter data into the Token value
Type URI (Uniform Resource Identifier) and local name fields. For
the token value type URI field, enter the following string: http://www.ibm.com/websphere/appserver/tokentype/5.0.2.
For the local name, enter the following string: LTPA
- Callback handler factory class name
- Creates
a JAAS CallbackHandler implementation that understands
the following callback handlers:
- javax.security.auth.callback.NameCallback
- javax.security.auth.callback.PasswordCallback
- com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback
- com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback
- com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback
For
any of the default authentication methods (BasicAuth, IDAssertion,
Signature, and LTPA), use the callback handler factory default implementation.
Enter the following class name for any of the default authentication
methods including LTPA: com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl
This
implementation creates the correct callback handler
for the default implementations.
- Callback
handler factory property
- Specifies callback handler properties
for custom callback handler
factory implementations. Default callback handler factory implementation
does not any property specifications. For LTPA, leave this field blank.
- Login mapping property
- Specifies properties
for a custom login mapping. For default implementations
including LTPA, leave this field blank.
What to do next
See the task for configuring the server to
handle LTPA token
authentication information if you have not previously specified this
information.