WAS v8.5 > Develop applications > Develop web services - Security (WS-Security) > Configure Web Services Security during application assembly > Configure pluggable tokens for v5.x web services with an assembly tool

Configure the server to handle LTPA token authentication information

Lightweight Third-Party Authentication (LTPA) is a type of authentication mechanism in WebSphere Application Server security that defines a particular token format. The purpose of the LTPA token authentication is to flow the LTPA token from the first web service, which authenticated the originating client, to the downstream web service. We can configure the server for LTPA token authentication. There is an important distinction between v5.x and v6.0.x and later applications. The information in this article supports v5.x applications only used with WAS v6.0.x and later. The information does not apply to v6.0.x and later applications.

This task is used to configure LTPA. Do not attempt to configure LTPA from a pure client. After the downstream web service receives the LTPA token, it validates the token to verify the token has not been modified and has not expired. For validation to be successful, the LTPA keys used by both the sending and receiving servers must be the same.

To specify that LTPA is the authentication method. The authentication method indicated in these steps must match the authentication method specified for the client.

  1. Launch an assembly tool. For more information, see the related information on Assembly Tools.
  2. Switch to the Java EE perspective. Click Window > Open Perspective > J2EE.

  3. Click EJB Projects > application_name > ejbModule > META-INF.
  4. Right-click the webservices.xml file, and click Open with > Web services editor.

  5. Click the Extensions tab, located at the bottom of the web services editor within the assembly tool.

  6. Expand the Request receiver service configuration details > Login configuration section. We can select from the following options:

  7. Select LTPA to authenticate the client using the LTPA token received from the request.

After we specify the authentication method, specify the information the server must validate. See Configure the server to validate LTPA token authentication information for more information.


Related concepts:

LTPA
Development and assembly tools


Related


Configure the server to validate LTPA token authentication information
Configure the server security bindings using an assembly tool
Configure the server security bindings
Configure the client for LTPA token authentication: specifying LTPA token authentication
Configure the client for LTPA token authentication: collecting the authentication method information


+

Search Tips   |   Advanced Search