LTPA overview

LTPA overview

WebSEAL can provide authentication and authorization services to an IBM WebSphere peer server environment. WebSphere provides support for the cookie-based lightweight third-party authentication mechanism (LTPA). When WebSEAL is positioned as a protective front-end to WebSphere, users are faced with two potential login points. To achieve a single signon solution to one or more IBM WebSphere servers across WebSEAL junctions, we can configure junctions to support LTPA.
When a user makes a request for a WebSphere resource, the user must first authenticate to WebSEAL. After successful authentication, WebSEAL generates an LTPA cookie on behalf of the user. The LTPA cookie, which serves as an authentication token for WebSphere, contains the user identity, key and token data, buffer length, and expiration information. This information is encrypted with a password-protected secret key that is shared between WebSEAL and the WebSphere server. WebSEAL inserts the cookie in the HTTP header of the request sent across the junction to WebSphere. The back-end WebSphere server receives the request, decrypts the cookie, and authenticates the user. The user is authenticated based on the identity information that is supplied in the cookie. To improve performance, WebSEAL can store the LTPA cookie in a cache and use the cached LTPA cookie for subsequent requests during the same user session. We can configure lifetime timeout and idle (inactivity) timeout values for the cached cookie.
WebSEAL supports both LTPA version 1 (LtpaToken) and LTPA version 2 (LtpaToken2) cookies. LTPA version 2 cookies are suggested for cases where the WebSphere server supports LtpaToken2.

LtpaToken Used for interoperating with previous releases of WebSphere Application Server. This token contains the authentication identity attribute only.
LtpaToken2 Contains stronger encryption and we can add multiple attributes to the token. This token contains the authentication identity and additional information such as the attributes. The attributes are used for contacting the original login server and the unique cache key. It is also used for looking up the Subject when considering more than just the identity in determining uniqueness.

See: LTPA single signon.

Configuration of an LTPA junction

Configuration of the LTPA cache

Technical notes for LTPA single sign-on

Parent topic: Single Sign-on Solutions

LtpaToken	Used for interoperating with previous releases of WebSphere Application Server. This token contains the authentication identity attribute only.
LtpaToken2	Contains stronger encryption and we can add multiple attributes to the token. This token contains the authentication identity and additional information such as the attributes. The attributes are used for contacting the original login server and the unique cache key. It is also used for looking up the Subject when considering more than just the identity in determining uniqueness.