Set the server to validate LTPA token authentication information

LTPA is a type of authentication mechanism in WAS security that defines a particular token format. The purpose of the LTPA token authentication is to flow the LTPA token from the first Web service, which authenticated the originating client, to the downstream Web service. Configure the server to validate LTPA token authentication.

There is an important distinction between Version 5.x and V6.0.x and later applications. The information in this article supports V5.x applications only that are used with WAS V6.0.x and later. The information does not apply to V 6.0.x and later applications.

This task is used to configure LTPA. Do not attempt to configure LTPA from a pure client. After the downstream Web service receives the LTPA token, it validates the token to verify that the token has not been modified and has not expired. For validation to be successful, the LTPA keys used by both the sending and receiving servers must be the same.

Complete the following steps to specify how the server must validate the LTPA token authentication information:

 

1. Launch an assembly tool.

   See the related information on Assembly Tools.

2. Switch to the Java2 Platform, Enterprise Edition (J2EE) perspective. Click Window > Open Perspective > J2EE.

3. Click EJB Projects > application_name > ejbModule > META-INF.

4. Right-click the webservices.xml file, and click Open with > Web services editor.

5. Click the Binding Configurations tab, which is located at the bottom of the Web services editor within the assembly tool.

6. Expand the Request receiver binding configuration details > Login mapping section.

7. Click Edit to view the login mapping information.

   The login mapping information is displayed. Select or enter the following information:

   Authentication method

   Type of authentication that occurs. Select LTPA to use LTPA token authentication.

   Configuration name

   (JAAS) login configuration name. For the LTPA authentication method, enter WSLogin for the JAAS login configuration name. This configuration understands how to validate an LTPA token.

   Use token value type

   Determines to specify a custom token type. For LTPA authentication, select this option because LTPA is considered a custom type. LTPA is not in the WS-Security Specification.

   Token value type URI and local name

   Specifies custom authentication types. If we select Use Token value type enter data into the Token value Type URI (Uniform Resource Identifier) and local name fields. For the token value type URI field, enter the following string: http://www.ibm.com/websphere/appserver/tokentype/5.0.2. For the local name, enter the following string:  LTPA

   Callback handler factory class name

   Creates a JAAS CallbackHandler implementation that understands the following callback handlers:

   • javax.security.auth.callback.NameCallback

   • javax.security.auth.callback.PasswordCallback

   • com.ibm.wsspi.wssecurity.auth.callback.BinaryTokenCallback

   • com.ibm.wsspi.wssecurity.auth.callback.XMLTokenReceiverCallback

   • com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback

   For any of the default authentication methods (BasicAuth, IDAssertion, Signature, and LTPA), use the callback handler factory default implementation. Enter the following class name for any of the default authentication methods including LTPA:

   com.ibm.wsspi.wssecurity.auth.callback.WSCallbackHandlerFactoryImpl
   

   This implementation creates the correct callback handler for the default implementations.

   Callback handler factory property

   Specifies callback handler properties for custom callback handler factory implementations. Default callback handler factory implementation does not any property specifications. For LTPA, leave this field blank.

   Login mapping property

   Specifies properties for a custom login mapping. For default implementations including LTPA, leave this field blank.

 

Next steps

See the task for configuring the server to handle LTPA token authentication information if we have not previously specified this information.

Lightweight Third Party Authentication

 

Related concepts

Assembly tools

 

Related tasks

Set the server to handle LTPA token authentication information
Set the server security bindings using an assembly tool
Set the server security bindings
Set the client for LTPA token authentication: specifying LTPA token authentication
Set the client for LTPA token authentication: collecting the authentication method information
Secure Web services for version 5.x applications using a pluggable token