Stack Overflow
Stack Overflow

Questions tagged [ltpa]

LTPA - Lightweight Third-Party Authentication is a IBM provided mechanism to achieve Single Sign-On between IBM WebSphere servers and Lotus Domino servers. Once a user is successfully authenticated a LTPA token will be stored as a cookie in the user's web browser, providing who the authenticated user is to other servers in the same configured SSO domain.

LTPA - Lightweight Third-Party Authentication is a IBM provided mechanism to achieve Single Sign-On between IBM WebSphere servers and Lotus Domino servers. If the server is configured to use LTPA, the server first checks for a valid LTPA token for the SSO domain the server has been configured for. If the LTPA token is not yet present the user must authenticate normally.

Technology

In order for a server to use the LTPA authentication mechanism, it must first be configured to do so. When configuring the usage of LTPA between servers, the servers must be in the same domain (also configured in the LTPA configuration) and use the same LTPA SSO key as each other. Once the user has been authenticated the first time, the server creates two cookies: LtpaToken and LtpaToken2. The latter is the latest version of the token, the former is used for backward compability with older servers. The cookies are encrypted and contains (as a minimum requirement) the user's login.

When the same user accesses another server in the same SSO domain, the user will not need to re-authenticate. The server will read the LTPA token and after validating it accept the users authentication.

The LTPA token is time sensitive and will eventually expire. As a result it is important that the time on the server is synchronized as the server might otherwise consider a fully valid token as invalid. How long the token is valid for is configured on the server.

More information

88 questions
2
votes
0 answers

Automatic login of User without entering credentials (LtpaToken)

What I am trying to achieve: Automatically login a user by creating a LtpaToken (No user id, password) Before the request comes to Domino server, the user will be already authenticated with an external system which adds a http header variable called…
Rajeev Menon
  • 284
  • 5
  • 16
2
votes
1 answer

Generate a LTPA2 token from SSO Login in a NodeJS Application

I have a node application which is SSO enabled. I need to call some REST API's which are implemented in a IBM Websphere Java project with Liberty Profile. For security reasons, the REST API's are expecting a LTPA(LTPA2) Token to be sent from the…
Olinda Sequeira
  • 21
  • 2
2
votes
2 answers

How does LTPA works as a SSO(single sign on) mechanism

I've got a basic knowledge of SSO principle from a good blog article Visit https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/# And I think to realize SSO, we use a central domain(such as LDAP or other Authentication Server) for…
Jiddu.K
  • 69
  • 9
2
votes
2 answers

LTPA Token Not Changing

When I log out of an application on WebSphere and back on, the LTPA token is unchanged. I thought it would change because session tokens are supposed to be unpredictable.
Brijesh
  • 21
  • 2
2
votes
0 answers

CORS and LTPA token from local domain

I'm struggling with CORS and a SSO configuration between two WAS servers using LTPA key share. CORS calls from server1 (domain1) to server2 (domain2) work fine if I don't have authentication on server2 (meaning the cross domain Ajax call works), but…
Guillaume Delory
  • 176
  • 1
  • 7
2
votes
2 answers

Using a Trust Association Interceptor (TAI) to obtain a LTPA2-Token

we have a custom web application hosted on a tomcat server and want to achieve to get an LTPA2Token when logging into this application on tomcat. All applications on both application servers are using the same LDAP.The application on the tomcat…
Ben
  • 1,579
  • 4
  • 20
  • 34
2
votes
2 answers

Generate LTPAToken 2 in custom Web Application

We want to realize a SSO-infrastructure with some IBM Domino / Websphere products and one custom web application. All IBM products are configured for SSO. Therefore, the WebSphere Application Server 8 generates an LTPAToken2 after successful login…
Ben
  • 1,579
  • 4
  • 20
  • 34
1
vote
2 answers

Passing on LPTA token on webservices call isn't working

I've got a j2ee web application using j2ee security, so the identity of the user is propagated from WebSEAL to the application, running in WAS7. I'm now trying to make a SOAP webservices call and propogate the user identity in that webservices call.…
user121356
1
vote
1 answer

JSF user logs in successfully even after user account was locked by LDAP

I use JSF 2 deployed on Liberty 22.0.0.6 server. My FORM based authentication is against LDAP using j_security_check. It is working and my user can log in/authenticate and get LTPA2 token back. And logout functionality works as well. However, I…
pixel
  • 9,653
  • 16
  • 82
  • 149
1
vote
2 answers

Decrypting LTPA2 token in tomcat and achieve SSO

We are implementing a SSO between WebSphere Application Server and Tomcat Using LTPA2 Token. As our client will be sending us the LTPA 2 Token once the user is Authenticated. And on the other hand we need to decrypt the LTPA2 token sent form our…
Noob of All Arts
  • 31
  • 2
1
vote
1 answer

Need to do SSO between IBM Websphere and my custom application

I am trying to do an SSO between IBM and my own custom application. Now, from what read I understood is LTPA is a mechanism used by WebSphere and other IBM products (e.g lotus products) as a means of authentication (typically for a Single Sign-on…
shv22
  • 680
  • 5
  • 28
1
vote
0 answers

How can I read the LtpaToken2 token from my XMLHttpRequest response?

I'm trying to debug another developers code which looks like this: xhr.open("POST", url, true, this.state.userid, this.state.password); xhr.withCredentials = true; xhr.onload = () => { console.log("here is our…
szaske
  • 1,887
  • 22
  • 32
1
vote
0 answers

Apache CXF non Spring WS-Security with LTPAToken on IBM WAS 8.5

I am trying to implement WS-Security with LTPAToken using CXF without Spring on IBM WAS. WAS provides a callback handler that does auth and returns the “Run As Subject”. This handler is called…
SatyaS
  • 27
  • 2
1
vote
1 answer

How to catch an LTPA WebSphere exception

When using LTPA basic authentication with WebSphere 7 if a password is incorrect an exception is thrown thus: [11/24/10 14:51:44:405 CET] 00000011 exception W com.ibm.ws.wim.adapter.file.was.FileAdapter login …
Gurnard
  • 1,773
  • 22
  • 43
1
vote
0 answers

3DESKey and LTPA password from IBM Bluemix cloud

How to get 3DESKey and LTPA password from IBM Bluemix cloud? I need it to decode user info from LtpaToken2 cookies. In Websphere I can get it from application server key file. There is com.ibm.websphere.ltpa.3DESKey property. Is there any similar…
Jaroslav Holaň
  • 23
  • 5
1
2
3 4 5 6