131 lines
5.7 KiB
HTML
131 lines
5.7 KiB
HTML
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||
|
|
<html>
|
||
|
|
<head>
|
||
|
|
<META http-equiv="Content-Type" content="text/html; charset=utf-8">
|
||
|
|
<LINK rel="stylesheet" type="text/css" href="../../../rzahg/ic.css">
|
||
|
|
|
||
|
|
<title>Configure the Web services server for LTPA token authentication</title>
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<BODY>
|
||
|
|
<!-- Java sync-link -->
|
||
|
|
<SCRIPT LANGUAGE="Javascript" SRC="../../../rzahg/synch.js" TYPE="text/javascript"></SCRIPT>
|
||
|
|
|
||
|
|
<h6><a name="wsseccfaltpasv"></a>Configure the Web services server for LTPA token authentication</h6>
|
||
|
|
|
||
|
|
<p>This task is used to configure Lightweight Third-Party Authentication (LTPA). LTPA is a type of
|
||
|
|
authentication mechanism in WebSphere Application Server - Express security that defines a particular
|
||
|
|
token format. The purpose of the LTPA token authentication is to send the LTPA token from the first Web
|
||
|
|
service, which authenticated the originating client, to the downstream Web service.</p>
|
||
|
|
|
||
|
|
<p>After the downstream Web service receives the LTPA token, it validates the token to verify that the
|
||
|
|
token has not been modified and has not expired. For validation to be successful, the LTPA keys that
|
||
|
|
are used by both the sending and receiving servers must be the same.</p>
|
||
|
|
|
||
|
|
<p><strong>Note:</strong> You can only configure client LTPA authentication for a Web service that
|
||
|
|
calls another Web service. Do not attempt to configure LTPA from a pure client.</p>
|
||
|
|
|
||
|
|
<p>Perform the following steps in the WebSphere Development Studio Client for iSeries to configure the
|
||
|
|
server for Web services signature authentication:</p>
|
||
|
|
|
||
|
|
<ol>
|
||
|
|
<li><p>Open the webservices.xml deployment descriptor for your Web services application in the Web
|
||
|
|
Services Editor of the WebSphere Development Studio Client for iSeries. For more information, see <a href="astk.htm">Configure your Web services application</a>.</p></li>
|
||
|
|
|
||
|
|
<li><p>Click the <strong>Security Extensions</strong> tab.</p></li>
|
||
|
|
|
||
|
|
<li><p>Expand the <strong>Request Receiver Service Configuration Details --> Login
|
||
|
|
Configuration</strong> settings.</p></li>
|
||
|
|
|
||
|
|
<li><p>Select <strong>LTPA</strong> to authenticate the client using the LTPA token received from the
|
||
|
|
request.</p></li>
|
||
|
|
|
||
|
|
<li><p>Save the file.</p></li>
|
||
|
|
</ol>
|
||
|
|
|
||
|
|
<p>Next, perform the following steps in the Web Services Editor to specify how the LTPA authentication
|
||
|
|
information is validated:</p>
|
||
|
|
|
||
|
|
<ol>
|
||
|
|
<li><p>Click the <strong>Binding Configurations</strong> tab.</p></li>
|
||
|
|
|
||
|
|
<li><p>Expand the <strong>Request Receiver Binding Configuration Details --> Login Mapping</strong>
|
||
|
|
settings.</p></li>
|
||
|
|
|
||
|
|
<li><p>Click <strong>Edit</strong> to view the Login Mapping information. The login mapping information
|
||
|
|
is displayed.</p></li>
|
||
|
|
|
||
|
|
<li><p>Select or enter the following information:</p>
|
||
|
|
|
||
|
|
<table border="1" cellpadding="3" cellspacing="0">
|
||
|
|
<tr valign="top">
|
||
|
|
<th>Name</th>
|
||
|
|
<th>Purpose</th>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Authentication method</strong></td>
|
||
|
|
<td>The authentication method specifies the type of authentication that occurs. Select
|
||
|
|
<strong>LTPA</strong> to use LTPA token authentication.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Configuration name</strong></td>
|
||
|
|
<td>This name specifies the Java Authentication and Authorization Service (JAAS) login configuration
|
||
|
|
name. For the LTPA authentication method, enter <tt>WSLogin</tt> for the JAAS login configuration name.
|
||
|
|
This configuration understands how to validate an LTPA token.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Use Token value type</strong></td>
|
||
|
|
<td>This option determines if you want to specify a custom token type. For LTPA authentication, you
|
||
|
|
must select this option because LTPA is considered a custom type. LTPA is not part of the Web services
|
||
|
|
security specification.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Token value type URI</strong> and <strong>local name</strong></td>
|
||
|
|
<td>If you select <strong>Use Token value type </strong>you must enter data into the <strong>Token
|
||
|
|
value Type URI</strong> and <strong>local name</strong> fields. For <strong>URI</strong>, enter
|
||
|
|
<tt>http://www.ibm.com/websphere/appserver/<br>
|
||
|
|
tokentype/5.0.2</tt>. For <strong>local name</strong>, enter
|
||
|
|
<tt>LTPA</tt>.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Callback Handler Factory Class Name</strong></td>
|
||
|
|
<td>This classname creates a JAAS CallbackHandler implementation that understands the following
|
||
|
|
callback handlers:
|
||
|
|
<ul>
|
||
|
|
<li>javax.security.auth.callback.<br>NameCallback</li>
|
||
|
|
<li>javax.security.auth.callback.<br>PasswordCallback</li>
|
||
|
|
<li>com.ibm.wsspi.wssecurity.auth.callback.<br>BinaryTokenCallback</li>
|
||
|
|
<li>com.ibm.wsspi.wssecurity.auth.callback.<br>XMLTokenReceiverCallback</li>
|
||
|
|
<li>com.ibm.wsspi.wssecurity.auth.callback.<br>PropertyCallback</li>
|
||
|
|
</ul>
|
||
|
|
<p>For any of the default Authentication methods (BasicAuth, IDAssertion, Signature, LTPA), use the
|
||
|
|
callback handler factory default implementation. Enter
|
||
|
|
<tt>com.ibm.wsspi.wssecurity.auth.callback.<br>WSCallbackHandlerFactoryImpl</tt> for any of the default
|
||
|
|
authentication methods, including LTPA. This implementation creates the correct callback handler for
|
||
|
|
the default implementations.</p></td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Callback Handler Factory Property</strong></td>
|
||
|
|
<td>This field is used to specify callback handler properties for custom callback handler factory
|
||
|
|
implementations. The default callback handler factory implementation does not need you to specify any
|
||
|
|
properties. For LTPA, you do not need to enter any properties for this field.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr valign="top">
|
||
|
|
<td><strong>Login Mapping Property</strong></td>
|
||
|
|
<td>This field is used to specify properties for a custom login mapping. For the default
|
||
|
|
implementations including LTPA, you do not need to enter any properties for this field.</td>
|
||
|
|
</tr>
|
||
|
|
</table></li>
|
||
|
|
</ol>
|
||
|
|
<p><strong>Note: </strong>Examples may be wrapped for display purposes.</p>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
</html>
|