This task is used to configure Lightweight Third-Party Authentication (LTPA). LTPA is a type of authentication mechanism in WebSphere Application Server - Express security that defines a particular token format. The purpose of the LTPA token authentication is to send the LTPA token from the first Web service, which authenticated the originating client, to the downstream Web service.
After the downstream Web service receives the LTPA token, it validates the token to verify that the token has not been modified and has not expired. For validation to be successful, the LTPA keys that are used by both the sending and receiving servers must be the same.
Note: You can only configure client LTPA authentication for a Web service that calls another Web service. Do not attempt to configure LTPA from a pure client.
Perform the following steps in the WebSphere Development Studio Client for iSeries to configure the server for Web services signature authentication:
Open the webservices.xml deployment descriptor for your Web services application in the Web Services Editor of the WebSphere Development Studio Client for iSeries. For more information, see Configure your Web services application.
Click the Security Extensions tab.
Expand the Request Receiver Service Configuration Details --> Login Configuration settings.
Select LTPA to authenticate the client using the LTPA token received from the request.
Save the file.
Next, perform the following steps in the Web Services Editor to specify how the LTPA authentication information is validated:
Click the Binding Configurations tab.
Expand the Request Receiver Binding Configuration Details --> Login Mapping settings.
Click Edit to view the Login Mapping information. The login mapping information is displayed.
Select or enter the following information:
| Name | Purpose |
|---|---|
| Authentication method | The authentication method specifies the type of authentication that occurs. Select LTPA to use LTPA token authentication. |
| Configuration name | This name specifies the Java Authentication and Authorization Service (JAAS) login configuration name. For the LTPA authentication method, enter WSLogin for the JAAS login configuration name. This configuration understands how to validate an LTPA token. |
| Use Token value type | This option determines if you want to specify a custom token type. For LTPA authentication, you must select this option because LTPA is considered a custom type. LTPA is not part of the Web services security specification. |
| Token value type URI and local name | If you select Use Token value type you must enter data into the Token value Type URI and local name fields. For URI, enter http://www.ibm.com/websphere/appserver/ tokentype/5.0.2. For local name, enter LTPA. |
| Callback Handler Factory Class Name | This classname creates a JAAS CallbackHandler implementation that understands the following callback handlers:
For any of the default Authentication methods (BasicAuth, IDAssertion, Signature, LTPA), use the callback handler factory default implementation. Enter com.ibm.wsspi.wssecurity.auth.callback. WSCallbackHandlerFactoryImpl for any of the default authentication methods, including LTPA. This implementation creates the correct callback handler for the default implementations. |
| Callback Handler Factory Property | This field is used to specify callback handler properties for custom callback handler factory implementations. The default callback handler factory implementation does not need you to specify any properties. For LTPA, you do not need to enter any properties for this field. |
| Login Mapping Property | This field is used to specify properties for a custom login mapping. For the default implementations including LTPA, you do not need to enter any properties for this field. |