IBM Lightweight Third-Party Authentication

Lightweight Third-Party Authentication (LTPAs), is an authentication technology used in IBM WebSphere and Lotus Domino products.When accessing web servers that use the LTPA technology it is possible for a web user to re-use his login across physical servers.

A Lotus Domino server or an IBM WebSphere server that is configured to use the LTPA authentication will challenge the web user for a name and password. When the user has been authenticated, his browser will have received a session cookie - a cookie that is only available for one browsing session. This cookie contains the LTPA token.

If the user – after having received the LTPA token – accesses a server that is a member of the same authentication configuration as the first server, and if the browsing session has not been terminated (the browser was not closed down), then the user is automatically authenticated and will not be challenged for a name and password. Such an environment is also called a Single-Sign-On (SSO) environment.

References

* [http://www-128.ibm.com/developerworks/ibm/library/it-0101art2/index.html DeveloperToolbox Technical Magazine: WebSphere and Domino single sign-on]
* [http://offbytwo.com/tutorials/2007/8/22/working-with-lightweight-third-party-authentication-ltpa.html Information on the LTPA format and source code to decode LTPA tokens]
* [http://www.openntf.org/Projects/pmt.nsf/ProjectLookup/DominoTomcatSSO DominoTomcatSSO at OpenNTF.org: A open source implementation of LTPA for Tomcat]