LTPA and LTPA v2 tokens

Network Deployment (Distributed operating systems), v8.0 > Secure applications and their environment > Secure web services > Secure web services > Web Services Security concepts > Web Services Security concepts > Web Services Security provides message integrity, confidentiality, and authentication

LTPA and LTPA v2 tokens

Web services security supports both LTPA (Version 1) and LTPA v2 (LTPA2) tokens. The LTPA2 token, which is more secure than v1, is supported by the JAX-WS runtime only. The support statements in this topic apply to the web services security implementation for WAS and not the security implementation for non-web services functionality.
The Lightweight Third Party Authentication (LTPA) token is a specific type of binary security token. The web services security implementation for WAS, v5 and later supports the LTPA v1 token. WAS v7 and later supports the LTPA v2 token using the JAX-WS runtime environment.
Although the same LTPAToken assertion is used in the policy for both LTPA v1 and LTPA v2, the valuetype value for the Version 2 token is different than v1. The valuetype value is composed of the URI and the local name. The following table shows the valuetype values for the LTPA token versions when they are selected as the token type for the policy set bindings. These values are not editable.

LTPA token versions and their valuetype values. This table lists the valuetype values for both LTPA (Version 1) and LTPA2 tokens.

LTPA vtoken Valuetype value
LTPA (Version 1) http://www.ibm.com/websphere/appserver/tokentype/5.0.2/LTPA
LTPA2 http://www.ibm.com/websphere/appserver/tokentype/LTPAv2

To allow for interoperability between servers that are running different versions of WAS, by default, the JAX-WS web services security runtime in v7.0 and later can successfully consume an LTPA v1 token when the binding is configured to expect an LTPA2 token. However, you can configure the binding for the JAX-WS runtime to accept only LTPA2 tokens. For more information, see the documentation about Authentication generator or consumer token settings.
If the web services security run time receives a token with a unrecognized valuetype value and the SOAP security header contains a mustUnderstand attribute value that is equal to '1', the web services security run time issues a SOAPFaultException error. If the mustUnderstand attribute value is equal to '0', the token is ignored.
If an LTPA2 token is sent with a mustUnderstand attribute value that is equal to '1' to a web services security run time in which the LTPA2 token is not supported, the run time does not recognize the LTPAv2 valuetype value. Thus, the receiving run time issues a SOAPFaultException error. The following table illustrates these different configurations and their potential error messages..
LTPA token configurations. This table lists whether the LTPA v1 token is optional or required, lists the associated mustUnderstand attribute value, lists its run time, and provides the resulting SOAPFaultException error, if applicable
Run time LTPA v1 token status MustUnderstand attribute value SOAPFaultException error
JAX-RPC
Required
1
com.ibm.wsspi.wssecurity.SoapSecurityException:
WSEC5509E: A security token whose type is
[{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA]
is required.
JAX-RPC
Required
0
com.ibm.wsspi.wssecurity.SoapSecurityException:
WSEC5509E: A security token whose type is
[{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA]
is required.
JAX-RPC
Optional
1
com.ibm.wsspi.wssecurity.SoapSecurityException:
WSEC5502E: Unexpected element as the target element:
s:BinarySecurityToken.
JAX-RPC Optional 0 None
JAX-RPC
Not Configured
1
com.ibm.wsspi.wssecurity.SoapSecurityException:
WSEC5502E: Unexpected element as the target element:
s:BinarySecurityToken.
JAX-RPC Not Configured 0 None
JAX-WS (Version 6.1 Feature Pack for Web Services)
Not Configured
1
CWWSS5502E: The target element:
s:BinarySecurityToken was not expected.
JAX-WS (Version 6.1 Feature Pack for Web Services) Not Configured 0 None
JAX-WS (Version 6.1 Feature Pack for Web Services)
Configured
1
CWWSS5509E: A security token whose type is
[{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA]
is required.
JAX-WS (Version 6.1 Feature Pack for Web Services)
Configured
0
CWWSS5509E: A security token whose type is
[{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA]
is required.
We can configure the JAX-WS run time to generate either LTPA (Version 1) or LTPA2 tokens. If you configure the LTPA token generator in a policy binding to generate an LTPA (Version 1) token, do one of the following:

Enable the single sign-on interoperability mode, which is available on the Single sign-on (SSO) panel within the admin console. For more information on this option, see the documentation about single sign-on settings.
Set the com.ibm.wsspi.wssecurity.tokenGenerator.ltpav1.pre.v7 custom property to true for the LTPA token generator.

If you do not perform at least one of the steps indicated above, an error occurs when the application, which is attached to these bindings, is started.
Binary security token
Web Services Security provides message integrity, confidentiality, and authentication
Enable or disabling single sign-on interoperability mode for the LTPA token

Related

Authentication generator or consumer token settings
Single sign-on settings
Enable or disabling single sign-on interoperability mode for the LTPA token

+
Search Tips | Advanced Search

LTPA vtoken	Valuetype value
LTPA (Version 1)	http://www.ibm.com/websphere/appserver/tokentype/5.0.2/LTPA
LTPA2	http://www.ibm.com/websphere/appserver/tokentype/LTPAv2

Run time	LTPA v1 token status	MustUnderstand attribute value	SOAPFaultException error
JAX-RPC	Required	1	com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5509E: A security token whose type is [{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA] is required.
JAX-RPC	Required	0	com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5509E: A security token whose type is [{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA] is required.
JAX-RPC	Optional	1	com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5502E: Unexpected element as the target element: s:BinarySecurityToken.
JAX-RPC	Optional	0	None
JAX-RPC	Not Configured	1	com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5502E: Unexpected element as the target element: s:BinarySecurityToken.
JAX-RPC	Not Configured	0	None
JAX-WS (Version 6.1 Feature Pack for Web Services)	Not Configured	1	CWWSS5502E: The target element: s:BinarySecurityToken was not expected.
JAX-WS (Version 6.1 Feature Pack for Web Services)	Not Configured	0	None
JAX-WS (Version 6.1 Feature Pack for Web Services)	Configured	1	CWWSS5509E: A security token whose type is [{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA] is required.
JAX-WS (Version 6.1 Feature Pack for Web Services)	Configured	0	CWWSS5509E: A security token whose type is [{http://www.ibm.com/websphere/appserver/tokentype/5.0.2}LTPA] is required.