IBM WebSphere V5.0 Security - CGISecurity

10.6.1 Single Sign-On
Single Sign-On is the process whereby users provide their credentials, user
identity, password and/or token, once within a session. These credentials are
available to all enterprise applications for which Single Sign-On was enabled
without prompting the user to reenter user name and password.
The goal is for an enterprise to be able to have one network identity per user,
allowing the centralized management of the various roles the user may have in
different applications, so correct rules can be applied without duplication of either
user data and without requiring multiple identities for the user.
In practice, network identity management is not yet mature enough within most
enterprises to achieve a single user registry, particularly when legacy
applications are exposed to the Web. Different application servers have typically
implemented their own security or utilized the operating environment security of
the platform on which they have been deployed. The task is then to authenticate
a user and provide, within the current session, a credential which can be passed
through to, and understood by, each application.
IBM has previously developed the Lightweight Third Party Authentication, (LTPA)
mechanism enabling Single Sign-On between various application servers. A
token, the transient cookie LtpaToken, is generated by the authenticating server;
for this book we configured WebSphere, WebSeal and Domino in different
scenarios to provide the LTPA token for Single Sign-On. The cookie is encrypted
using LTPA keys which must be shared among all Single Sign-On participating
servers, and contains user authentication information, the network domain in
which it is valid for Single Sign-On, and an expiry time.
The token is issued to the Web user in a cookie called a transient cookie; this
means that the cookie resides in the browser memory, is not stored on the user’s
computer system and expires when the user closes the browser. This cookie is
easily recognized by its name: LtpaToken.
The public domain has largely adopted Kerberos technology to provide the same
functionality.
Tivoli Access Manager, with its reverse proxy security server, WebSeal, provides
a more robust mechanism for Single Sign-On which can be used in conjunction
with LTPA and TAI (Trust Association Interceptor) provided as the Trust
Association Mechanism (TAM). Access Manager can integrate most back-end
application servers using the Global Sign-On mechanism to third party user
registries or extensions to the TAM schema to include legacy user identities and
passwords.
Chapter 10. Administering WebSphere security 251