IBM WebSphere V5.0 Security - CGISecurity

12.4.1 Single Sign-On with WebSEALWhen using a reverse proxy such as WebSEAL to authenticate users in theDMZ, it is desireable that WebSphere, as well as other back-end applications andservices, trust the authentication that has been performed and the identity that isbeing presented by the reverse proxy. If this trust can be established, users thenneed only authenticate once to the reverse proxy in order to have access to allauthorized services located behing that proxy. This is commonly known asReverse Proxy Single Sign-On, or RPSS.There are two ways to establish a trust relationship between WebSphere andWebSEAL:1. Using Lightweight Third Party Authentication (LTPA) tokens2. Using a Trust Association Interceptor(TAI)Each of these mechanisms of estabilishing trust will be discussed in detail below.Lightweight Third-Party AuthenticationAn LTPA token is an encrypted string that contains a userID, an expiration time,and a digital signature. By returning a cookie containing this string (known as anLTPA cookie) to client browsers upon successful authentication, other serverswhich trust the issuer of the LTPA cookie can request the cookie, read the LTPAtoken and determine the authenticated userID. The basis of trusting the issurer ofthe LTPA cookie is that the LTPA token contains the correct digital signature.Note: The third party referred to in the name Lightweight Third-PartyAuthentication refers to the server which performed the user authenticationand issued the LTPA token. Third party, therefore, does not refer to theregistry being used to authenticate principals. Servers which trust the thirdparty authenticator are said to have delegated authentication to this thirdparty. Confusingly, some documents refer to the user registry as the third partyin an LTPA environment.Note: LTPA is an IBM technology that is currently understood only by IBMproducs such as WebSphere Application Server, WebSEAL, and LotusDomino. LTPA has not received industry-wide acceptance.386 IBM WebSphere V5.0 Security Handbook