Configure the server to handle LTPA token authentication information

This task is used to configure Lightweight Third Party authentication (LTPA). LTPA is a type of authentication mechanism in WebSphere Application Server security that defines a particular token format. The purpose of the LTPA token authentication is to flow the LTPA token from the first Web service, which authenticated the originating client, to the downstream Web service. Do not attempt to configure LTPA from a pure client.  Once the downstream Web service receives the LTPA token, it validates the token to verify that the token has not been modified and has not expired.  For validation to be successful, the LTPA keys used by both the sending and receiving servers must be the same.

Complete the following steps to specify that LTPA is authentication method. The authentication method indicated in these steps must match the authentication method specified for the client.

1. Launch the Assembly Toolkit.

2. Open the J2EE perspective by clicking Window > Open Perspective > Other > J2EE.

3. Select the Web services-enabled Enterprise JavaBean (EJB) or Web module.

4. In the Project Navigator window, locate the META-INF directory for an EJB module or the WEB-INF directory for a Web module.

5. Right-click the webservices.xml file, select Open With > Web Services Editor.

6. Click the Security Extensions tab, which is located at the bottom of the Web services client editor within the Assembly Toolkit.

7. Expand the Request Receiver Service Configuration Details > Login Configuration section.You can select from the following options:

   • BasicAuth

   • Signature

   • ID assertion

   • LTPA

8. Select LTPA to authenticate the client using the LTPA token received from the request.

After you specify the authentication method, specify the information that the server must validate. See Configuring the server to validate LTPA token authentication information for more information.

 

See Also

Lightweight Third Party Authentication
Securing Web services using a pluggable token
Configuring the server to validate LTPA token authentication information
Configuring the server security bindings using the Assembly Toolkit
Configuring the server security bindings using the administrative console
Configuring the client for LTPA token authentication: specifying LTPA token authentication
Configuring the client for LTPA token authentication: Collecting the authentication method information

 

---