Disable automatic generation of LTPA keys
We can disable the automatic generation of new Lightweight Third Party Authentication (LTPA) keys for key sets that are members of a key set group. Automatic generation creates new keys on a schedule specified when we configure a key set group, which manages one or more key sets. WebSphere Application Server uses key set groups to automatically generate cryptographic keys or multiple synchronized key sets.
We must know the name of the key set group and the management scope where the key set group is defined.
The default key set group is CellLTPAKeySetGroup.
LTPA keys are used to encrypt the LTPA token.
We might want to disable the automatic generation of these keys so that we can generate them on a schedule. We should definitely disable automatic key generation if we disable node automatic synchronization. This disabling eventually causes the LTPA keys to fall out of synchronization between the deployment manager and the node agents. Also, we should disable automatic key generation if we import or export LTPA keys to or from another cell. The automatic generation of LTPA keys changes keys over time and causes the cells to fall out of synchronization.
The following steps are needed to complete this task in the administrative console.
Disable the automatic generation of LTPA keys
- Click...
Security > SSL certificate and key management > Manage endpoint security configurations
- Expand the tree and select desired inbound or outbound management scope.
- Under Related Items, click Key Set Groups.
- Click the key set group to disable.
- Clear the Automatically generate keys option.
- Click OK and Save to save the changes to the master configuration.
- Start the server again for the changes to become active.
We have disabled the automatic generation of LTPA keys for the key sets in the key set group.
Tip: We can generate keys manually at any time by completing the following steps:
- Open the key set group collection.
- Select the check box for the key set group.
- Click Generate keys.
Related:
LTPA key sets and key set groups Generate LTPA keys