Configure the server to validate LTPA token authentication information: WAS v5.1

Configure the server to validate LTPA token authentication information

This task is used to configure Lightweight Third Party authentication (LTPA). LTPA is a type of authentication mechanism in WebSphere Application Server security that defines a particular token format. The purpose of the LTPA token authentication is to flow the LTPA token from the first Web service, which authenticated the originating client, to the downstream Web service. Do not attempt to configure LTPA from a pure client. Once the downstream Web service receives the LTPA token, it validates the token to verify that the token has not been modified and has not expired. For validation to be successful, the LTPA keys used by both the sending and receiving servers must be the same.
Complete the following steps to specify how the server must validate the LTPA token authentication information...

Launch the Assembly Toolkit.
Open the J2EE perspective by clicking Window > Open Perspective > Other > J2EE.
Select the Web services-enabled Enterprise JavaBean (EJB) or Web module.
In the Project Navigator window, locate the META-INF directory for an EJB module or the WEB-INF directory for a Web module.
Right-click the webservices.xml file, and click Open With > Web Services Editor.
Click the Binding Configurations tab, which is located at the bottom of the Web services client editor within the Assembly Toolkit.
Expand the Request Receiver Binding Configuration Details > Login Mapping section.
Click Edit to view the login mapping information. The login mapping information is displayed. Select or enter the following information...

Authentication method Specifies the type of authentication that occurs. Select LTPA to use LTPA token authentication.

Configuration name Specifies the JAAS login configuration name. For the LTPA authentication method, enter WSLogin for the JAAS login configuration name. This configuration understands how to validate an LTPA token.

Use token value type Determines if you want to specify a custom token type. For LTPA authentication, select this option because LTPA is considered a custom type. LTPA is not in the Web Services Security Specification.

Token value type URI and local name Specifies custom authentication types. If you select Use Token value type enter data into the Token value Type URI and local name fields. For the token value type URI field, enter the following string: http://www.ibm.c../WAS51/appserver/tokentype/5.0.2. For the local name, enter the following string: LTPA

Callback handler factory class name Creates a JAAS CallbackHandler implementation that understands the following callback handlers...

javax.security.auth.callback.NameCallback
javax.security.auth.callback.PasswordCallback
com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback
com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback
com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback
For any of the default authentication methods (BasicAuth, IDAssertion, Signature, and LTPA), use the callback handler factory default implementation. Enter the following class name for any of the default authentication methods including LTPA: com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl
This implementation creates the correct callback handler for the default implementations.

Callback handler factory property Specifies callback handler properties for custom callback handler factory implementations. Default callback handler factory implementation does not any property specifications. For LTPA, you can leave this field blank.

Login mapping property Specifies properties for a custom login mapping. For default implementations including LTPA, you can leave this field blank.

See Configuring the server to handle LTPA token authentication if you have not previously specified this information.

See Also
Lightweight Third Party Authentication
Securing Web services using a pluggable token
Configuring the server to handle LTPA token authentication information
Configuring the server security bindings using the Assembly Toolkit
Configuring the server security bindings using the administrative console
Configuring the client for LTPA token authentication: specifying LTPA token authentication
Configuring the client for LTPA token authentication: Collecting the authentication method information

Authentication method	Specifies the type of authentication that occurs. Select LTPA to use LTPA token authentication.
Configuration name	Specifies the JAAS login configuration name. For the LTPA authentication method, enter WSLogin for the JAAS login configuration name. This configuration understands how to validate an LTPA token.
Use token value type	Determines if you want to specify a custom token type. For LTPA authentication, select this option because LTPA is considered a custom type. LTPA is not in the Web Services Security Specification.
Token value type URI and local name	Specifies custom authentication types. If you select Use Token value type enter data into the Token value Type URI and local name fields. For the token value type URI field, enter the following string: http://www.ibm.c../WAS51/appserver/tokentype/5.0.2. For the local name, enter the following string: LTPA
Callback handler factory class name	Creates a JAAS CallbackHandler implementation that understands the following callback handlers... javax.security.auth.callback.NameCallback javax.security.auth.callback.PasswordCallback com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback For any of the default authentication methods (BasicAuth, IDAssertion, Signature, and LTPA), use the callback handler factory default implementation. Enter the following class name for any of the default authentication methods including LTPA: com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl This implementation creates the correct callback handler for the default implementations.
Callback handler factory property	Specifies callback handler properties for custom callback handler factory implementations. Default callback handler factory implementation does not any property specifications. For LTPA, you can leave this field blank.
Login mapping property	Specifies properties for a custom login mapping. For default implementations including LTPA, you can leave this field blank.