Stack Overflow
Stack Overflow

Questions tagged [ltpa]

LTPA - Lightweight Third-Party Authentication is a IBM provided mechanism to achieve Single Sign-On between IBM WebSphere servers and Lotus Domino servers. Once a user is successfully authenticated a LTPA token will be stored as a cookie in the user's web browser, providing who the authenticated user is to other servers in the same configured SSO domain.

LTPA - Lightweight Third-Party Authentication is a IBM provided mechanism to achieve Single Sign-On between IBM WebSphere servers and Lotus Domino servers. If the server is configured to use LTPA, the server first checks for a valid LTPA token for the SSO domain the server has been configured for. If the LTPA token is not yet present the user must authenticate normally.

Technology

In order for a server to use the LTPA authentication mechanism, it must first be configured to do so. When configuring the usage of LTPA between servers, the servers must be in the same domain (also configured in the LTPA configuration) and use the same LTPA SSO key as each other. Once the user has been authenticated the first time, the server creates two cookies: LtpaToken and LtpaToken2. The latter is the latest version of the token, the former is used for backward compability with older servers. The cookies are encrypted and contains (as a minimum requirement) the user's login.

When the same user accesses another server in the same SSO domain, the user will not need to re-authenticate. The server will read the LTPA token and after validating it accept the users authentication.

The LTPA token is time sensitive and will eventually expire. As a result it is important that the time on the server is synchronized as the server might otherwise consider a fully valid token as invalid. How long the token is valid for is configured on the server.

More information

88 questions
1
vote
1 answer

Lotus Domino Server with Kerberos Authentication and XPages

Really weird authentication problem going on - hope someone can help! The Domino Web Server Log database shows all the requests a particular user is making for pages in an application I look after. The application is XPages-based and the user is…
asummers
  • 177
  • 1
  • 15
1
vote
0 answers

Why do I get Unexpected viewExpiredException when authenticated?

I'm working on an application using WAS 7.0 and Richfaces 3.3.3. When I was working without authentication, I had only ViewExpiredException as expected, after a timeout. Now that I'm going thru Webseal, with LTPA cookie, to the same machine, I get…
Lenn
  • 143
  • 1
  • 6
1
vote
1 answer

Can I obtain an LTPA token from WebSphere Trust Association Interceptor?

I'm developing a smartphone app to run under iOs, which will call Websphere OpenSCA components, via Web Service bindings. I want to protect the Web Services using an LTPA token in a WSSE-Security binaryToken. The client wants to have users sign on…
Greycon
  • 793
  • 6
  • 19
1
vote
1 answer

Handling LTPA token timeout (websphere 7.x) in JSF richfaces 3.3

I am using JSF richfaces 3.3 on websphere server 7.x. The problem is when user logged in to the application using a browser window and had kept it open for more than LTPA token time out time then LTPA token expiration exception is occurring. Then…
Vamshi
  • 11
  • 2
0
votes
1 answer

Keycloak 15.0.2 Integration with IBM Websphere Portal server version 6.1 using JDK 6

In Current production we are running Two Applications one on WebSphere Application Server 7.0 and one with WebSphere Portal Server 6.1. User currently login to WebSphere Portal and can redirect to WAS if needed. The SSO done by LTPA based SSO on…
RSharma
  • 1
  • 2
0
votes
1 answer

How to request LtpaToken2 from an application hosted on WebSphere

Can anyone please let me know if it is possible to request a LtpaToken2 from an application hosted on WebSphere? I have a vb.net client application which is using a REST API hosted on WebSphere. I initially connect to the API with the user name and…
user12566716
  • 3
  • 1
0
votes
0 answers

Why is LTPA Cookie missing in my WAS Liberty environment?

I have configured OIDC authentication (external OP) with WAS Liberty Profile version WebSphere Application Server 21.0.0.7/wlp-1.0.54.cl210720210629-1900. While testing, the OIDC authentication is successful and I see the following cookies set by…
Jatin
  • 667
  • 8
  • 16
0
votes
1 answer

Custom TAI not generating LtpaToken2

I'm using WebSphere Application 8.5.5.17. After switching to custom Trust association interceptor (TAI) from webgate, IBM Websphere does not generate LtpaToken2 for Single-sign on. The TAI is loading just fine without any issue. Are there extra…
sayhaha
  • 769
  • 3
  • 12
  • 25
0
votes
1 answer

Ignore LtpaToken in WebSphere Liberty

My organization already has some web applications deployed on a liberty server, using its SSO, which sets an LtpaToken cookie for the entire intranet domain. Now we are switching to openidconnect authenticated, sessionless (with JWT) secured web…
rslemos
  • 2,454
  • 22
  • 32
0
votes
0 answers

HCL Domino: how to drop users logged in with LtpaToken

Before I start here: this is a duplicate from another post at serverFault.com ("https://serverfault.com/questions/1009946/hcl-domino-how-to-drop-users-logged-in-with-ltpatoken"); I first felt that would be the place to ask, but since I never got an…
Lothar Mueller
  • 2,528
  • 1
  • 16
  • 29
0
votes
0 answers

SESN0008E when login in ibm/console at the same time with login in application

Environment: WebSphere AS 9.0.0.10. I am trying to log in in my app(http://myhost:9080/myapp/login.xhtml), that deployed at WAS and next log in WAS administrative console(https://myhost:9043/ibm/console). After a successful log in my app in the next…
Dmitry Zorin
  • 13
  • 4
0
votes
3 answers

Websphere 9, how to check incoming ltpatoken2

Good day I have an incoming request to my application based on websphere 9 with ltpatoken2 cookie. Previously, the ltpa key was exported from my websphere and add to another server. The option Application security was enabled. How I can check, at…
Adares
  • 3
  • 3
0
votes
1 answer

what should be the User-Agent header for this call?

this code snippet is taken from Postman. cURL taken from the postman works fine and java code generated from postman gives a 200 response for the particular call. but the response body is not there. what should be the user agent header? Do I need…
senura
  • 21
  • 1
  • 5
0
votes
1 answer

How to resolve Websphere web application login delay due to LTPA token expiration?

I am running a web application on Websphere application server BASE 9.0.0.8. Websphere security is configured with standalone LDAP registry(OpenLdap), which is also registry for application users. After server is started user login is normal and…
asmoljo
  • 71
  • 2
  • 7
0
votes
1 answer

Unable to get the LTPA token using Rest assured

I am new to rest assured, I want to perform some get and post for test data generation using rest assured. But I am unable to get the LTPA token and pass them to post. This works with postman but I want to do it through java. Any help final String…
arul k
  • 1
1 2 3
4
5 6