22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

288 Lotus Security Handbook<br />

Data Value<br />

PrivateKey-ltpa Private Key (corresponding to a Public Key that other servers<br />

can access) used by LtpaServer to sign the authentication<br />

data; this private key should be accessible to LtpaServer only.<br />

SharedKey A symmetric/shared 3DES key that is shared by LtpaServer<br />

and other servers for encrypting/decrypting token.<br />

UserData Name value pairs separated by delimiter”$”. (for example,<br />

“uid:”+user ID)<br />

TokenExpirationDate A number representing the time and date of the token<br />

expiration. (TokenExpirationDate is the number of milliseconds<br />

to elapse since midnight (00:00:00), January 1, 1970).<br />

Note within the encoded structure there is a digital signature. This is a signature<br />

by the issuing server using the server’s private key (in the case of a Domino<br />

server), or a pseudo-randomly generated key (in the case of a WebSphere<br />

server).<br />

LTPA token interrogation (decoding)<br />

If the user already has an LTPA token, then the token is validated by the Web<br />

server that receives it. The Web server might in turn request the authentication<br />

mechanism to validate the credential (in this case, an LTPA token). If the token is<br />

valid, the user is considered authenticated.<br />

The following example shows the debug log output from a Domino server<br />

performing three steps on a WebSphere-generated LTPA token it receives:<br />

decoding the Base-64 encoding, decrypting using the shared secret key<br />

(imported from WebSphere), and determining if the user name in the token<br />

should be trusted as an authenticated user.<br />

Example 7-1<br />

06/09/2003 05:53:39.53 PM [03071:00010-106510] SSO API> Decoding Websphere<br />

style Single Sign-On token (LTPA).<br />

06/09/2003 05:53:39.53 PM [03071:00010-106510] SSO API> Dumping memory of<br />

encoded token [364 bytes].<br />

00000000: 6C71 3150 4847 4536 3576 597A 6154 7878 'qlP1GH6Ev5zYTaxx'<br />

00000010: 6F5A 534D 4262 6D70 3746 4643 6B56 3172 'ZoMSbBpmF7CFVkr1'<br />

00000020: 5146 7045 5762 756E 6467 4532 6C68 314B 'FQEpbWnugd2EhlK1'<br />

00000030: 3138 6E47 5164 5A41 634C 3965 3258 386C '81GndQAZLce9X2l8'<br />

00000040: 2B7A 7239 7263 7976 5537 6332 4957 4F44 'z+9rcrvy7U2cWIDO'<br />

00000050: 3755 4677 586D 2B6B 3768 7A31 3767 6976 'U7wFmXk+h71zg7vi'<br />

00000060: 3672 5949 4672 7566 4C4D 636E 6236 665A 'r6IYrFfuMLnc6bZf'<br />

00000070: 6E63 6A43 6246 4476 7159 476A 2F72 5445 'cnCjFbvDYqjGr/ET'<br />

00000080: 6742 6C57 7779 7457 3671 6632 7467 3978 'BgWlywWtq62fgtx9'

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!