Lightweight Third-Party Authentication (LTPA) is a type of authentication
mechanism in WebSphere® Application
Server security that defines a particular token format. The purpose of the
LTPA token authentication is to flow the LTPA token from the first Web service,
which authenticated the originating client, to the downstream Web service.
You can configure the server to validate LTPA token authentication.
About this task
Important: There is an important distinction between
Version 5.x and Version 6.0.x and later applications. The information
in this article supports Version 5.x applications only that are used
with WebSphere Application
Server Version 6.0.x and later. The information does not apply to Version
6.0.x and later applications.
This task is
used to configure LTPA. Do not attempt to configure LTPA from a pure client.
After the downstream Web service receives the LTPA token, it validates the
token to verify that the token has not been modified and has not expired.
For validation to be successful, the LTPA keys used by both the sending and
receiving servers must be the same.
Complete the following steps to
specify how the server must validate the LTPA token authentication information:
Procedure
- Launch an assembly tool. For more information, see the
related information on Assembly Tools.
- Switch to the Java 2 Platform, Enterprise Edition (J2EE)
perspective. Click Window > Open Perspective > J2EE.
- Click EJB Projects > application_name >
ejbModule > META-INF.
- Right-click the webservices.xml file, and click Open
with > Web services editor.
- Click the Binding Configurations tab, which is located at the bottom
of the Web services editor within the assembly tool.
- Expand the Request receiver binding configuration details >
Login mapping section.
- Click Edit to view the login mapping information.
The login mapping information is displayed. Select or enter the following
information:
- Authentication method
- Specifies the type of authentication that occurs. Select LTPA to
use LTPA token authentication.
- Configuration name
- Specifies the Java Authentication and Authorization Service (JAAS)
login configuration name. For the LTPA authentication method, enter WSLogin for
the JAAS login configuration name. This configuration understands how to validate
an LTPA token.
- Use token value type
- Determines if you want to specify a custom token type. For LTPA authentication,
you must select this option because LTPA is considered a custom type. LTPA
is not in the Web Services Security Specification.
- Token value type URI and local name
- Specifies custom authentication types. If you select Use Token value
type you must enter data into the Token value Type URI (Uniform Resource
Identifier) and local name fields. For the token value type URI field, enter
the following string: http://www.ibm.com/websphere/appserver/tokentype/5.0.2.
For the local name, enter the following string: LTPA
- Callback handler factory class name
- Creates a JAAS CallbackHandler implementation that understands the following
callback handlers:
- javax.security.auth.callback.NameCallback
- javax.security.auth.callback.PasswordCallback
- com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback
- com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback
- com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback
For any of the default authentication methods (BasicAuth, IDAssertion,
Signature, and LTPA), use the callback handler factory default implementation.
Enter the following class name for any of the default authentication methods
including LTPA: com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl
This
implementation creates the correct callback handler for the default implementations.
- Callback handler factory property
- Specifies callback handler properties for custom callback handler factory
implementations. Default callback handler factory implementation does not
any property specifications. For LTPA, leave this field blank.
- Login mapping property
- Specifies properties for a custom login mapping. For default implementations
including LTPA, leave this field blank.
What to do next
See the task for configuring the server to handle LTPA token authentication
information if you have not previously specified this information.