Front cover - IBM Redbooks

7.2.1 Authentication
With LTPA as the authentication mechanism, a trusted third party server is used
to authenticate the user. Depending on whether a token has already been issued
to the user, there are two possible actions a Web server might perform. The two
actions or mechanisms are:
1. Creation (encoding) the LTPA token by the initial server the user logs into
2. Interrogation (decoding) of an LTPA token provided by the browser in the
HTTP request to a server
LTPA token creation (encoding)
Users are authenticated once per session. The initial authentication using LTPA
is based on a name and password stored in an LDAP directory, where the
directory is trusted by all the applications that are to share the LTPA session
cookie. Note that the LDAP directory server is referred to as a “trusted third
party,” hence the part of the name: “Third Party Authentication.” When a user
provides a logon name (ID) and password to the initial server in the LTPA
environment, it provides these credentials in a bind request against the LDAP
directory server. The LDAP directory server hashes the password string, then it
is compared to the stored password hash value in the user’s record in the
directory. If the hash from the logon matches the hash stored in the directory, the
“bind” is successful. Upon a successful LDAP bind, the initial Web server
(typically a portal server) will generate an LTPA token and provide this cookie
back to the browser. The browser will then provide this cookie in every
subsequent HTTP request by the user to servers that are within the domain listed
in the cookie. The amount of information contained in the cookie is relatively
minimal, hence the term “Lightweight.” The structure of an LTPA token is shown
in Table 7-1.
Table 7-1 LTPA token data definition
Data Value
CookieName "LtpaToken"
CookieValue Base64Encoded(LtpaToken)
LtpaToken Encrypt(AuthenticationToken, SharedKey) using 3DES
AuthenticationToken UserData+"%"+TokenExpirationDate+"%"+
Base64Encoded(DigitalSignature)
DigitalSignature Sign (UserData, TokenExpirationDate) using PrivateKey-ltpa.
(using RSA/SHA1)
Chapter 7. Single sign-on 287