Websphere 9, how to check incoming ltpatoken2

Question

Good day I have an incoming request to my application based on websphere 9 with ltpatoken2 cookie. Previously, the ltpa key was exported from my websphere and add to another server. The option Application security was enabled. How I can check, at websphere or at my application, that the token is exists and correct? And my application should be not avialable for requests without token.

score 0 · Answer 1 · answered Nov 17 '19 at 13:34

There's no API to inspect that token, but you can test it implicitly. You can capture browser traffic with Firefox or Chrome developer tools, then after successful login, using either the browser tools or curl, send a modified request without the cookie, or with a bad cookie value, and you should get an authentication challenge since the cookie's not there.

score 0 · Accepted Answer · edited Jul 25 '20 at 23:55

0

In WebSphere 9, if request contains a LTPA cookie, LTPA cookie will be processed automatically. Inside your application code, if you call API com.ibm.websphere.security.auth.WSSubject.getRunAsSubject(), you will see a subject created form the ltpa token if LTPA token is presented and is also valid.

And you will see unauthenticated subject if ltpa is missing or invalid. Or inside your application, if you call HttpServletRequest.getPrincipal().getName(), you will see a user name represented by the LTPA cookie if it presents and valid, and you will see principal name or see unauthenticated user name if LTPA is missing or invalid.

edited Jul 25 '20 at 23:55

galoget

722
9
15

answered Nov 18 '19 at 03:30

Chunlong

616
5
9

Do you explain for me? I have two servers - webseal and websphere. On websphere I exported ltpa key and enable security application check. On webseal I imported ltpa key. My code: – Adares Nov 20 '19 at 17:14
https://stackoverflow.com/questions/58960099/check-ltpa-token-between-webseal-and-websphere-9-0 – Adares Nov 20 '19 at 17:25

score 0 · Answer 3 · answered Nov 18 '19 at 08:35

The easiest would be to just add security constraints to your web.xml protecting whole application (you will find many examples), and map security role to All authenticated. Then your application will be available only, if user is already logged in (so the LTPA token exists and is correct), otherwise it will redirect you to login page that you can include in your application and redirect user somewhere, informed that he is not logged in, or whatever you want to do in case there is no valid LTPA token.

Websphere 9, how to check incoming ltpatoken2

3 Answers3