Download PDF - IBM Redbooks

in the cell. In a deployment manager configuration, the LTPA keys generated at
the deployment manager level are automatically replicated to all servers’
members of the same cell.
In a multiple-cell environment, LTPA keys and security configurations are likely
to be different by default and need some adjustment to be able to communicate.
Cross-cell identity propagation or single sign-on
As described before, identity propagation or single sign-on relies on the single
sign-on token (new LtpaToken2) or on the authentication token (old LtpaToken)
for backwards compatibility. The user identity is stored encrypted in this token.
For cross-cell single sign-on to happen, all servers must be able to decrypt the
single sign-on token (new LtpaToken2). Hence, they must all share the same
LTPA key. If LTPA keys are generated separately in every cell, then all LTPA
keys are different, and servers from one cell are not able to decrypt single
sign-on tokens coming from other cells. See Figure 9-4.
Figure 9-4 Cross-cell identity propagation or single sign-on and LTPA tokens
To share the same LTPA key, it is necessary to generate the LTPA key once in
one cell, to export this LTPA key, and to import this LTPA key in any other cell
that you want to single sign-on with. Then all servers share the same LTPA, and
they are all able to decrypt the LTPA token coming from another.
This applies to identity propagation among front-end servers (horizontal with
HTTP and cookies) and for identity propagation to back-end servers (vertical or
downstream with RMI-IIOP or Web services and tokens).
Chapter 9. Security attribute propagation and CSIv2 303