WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

export them from one cell and import them to the other. For security purposes,
the exported keys are encrypted with a user-defined password. This same
password is needed when importing the keys into another cell.
Note: When security is enabled during profile creation time, LTPA is
configured by default.
When security is enabled for the first time with LTPA, configuring LTPA is
normally the initial step performed. LTPA requires that the configured user
registry be a centrally shared repository, such as an LDAP or a Windows domain
type registry, so that users and groups are the same regardless of the machine.
LTPA keys are generated automatically during the first server startup and
regenerated before they expire. You can disable automatic regeneration by
WebSphere Application Server so you can generate them on a schedule.
Kerberos
Warning: At the time of writing, the Kerberos and LTPA option is not available.
It has been included in this book because it will be supported in a future
update.
Although being new to WebSphere Application Server V7.0, Kerberos is a
mature, standard authentication mechanism that enables interoperability with
other applications that support Kerberos authentication. It provides single sign on
(SSO) end-to-end interoperable solutions and preserves the original requester
identity. Kerberos is composed of three parts: a client, a server, and a trusted
third party known as the Kerberos Key Distribution Center (KDC). The KDC
provides authentication and ticket granting services.
The KDC maintains a database or repository of user accounts for all of the
security principals in its realm. Many Kerberos distributions use file-based
repositories for the Kerberos principal and policy database and others use
Lightweight Directory Access Protocol (LDAP) as the repository.
A long-term key for each principal 1 is maintained by the KDC in its accounts
database. This long-term key is derived from the password of the principal. Only
the KDC and the user that the principal represents should know the long-term
key or password.
1 A principal is a unique identity which represents a user.
Chapter 12. Security 387