生成 LTPA 令牌？
我们需要将一个不支持 LTPA 的服务器与我们的 WebSphere 环境集成。我发现 Cosmin Stejerean 的《使用轻量级第三方身份验证 (LTPA)》 和相应的代码来解码 LTPA 令牌中的信息。但是，没有代码解释数字签名及其生成/验证方式。有人知道如何在自定义代码中生成 LTPA 令牌吗？
We have a need to integrate a server with our WebSphere environment that does not support LTPA. I found Working with Lightweight Third Party Authentication (LTPA) by Cosmin Stejerean and corresponding code to decode the information in an LTPA token. However, there's no code explaining the digital signature and how that's generated/validated. Does anyone have any information on how to generate an LTPA token in custom code?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您需要指定您想要集成的方式和内容？
LTPA 是 WebSphere 和其他 IBM 产品（例如 Lotus 产品）用作身份验证手段（通常用于 SSO 上的单点登录）的机制。
如果 WebSphere App Server（作为示例）对用户进行身份验证，并且请求说发送到Lotus 产品（属于同一域的一部分），Lotus 产品通过 WAS 生成的 LTPA 令牌来识别用户。
这同样适用于多个 WebSphere 产品。
LTPA 没有可供用户使用的公共 API，它旨在供各种 IBM 产品使用。
华泰
曼鲁
You would need to specify how and what you want to integrate?
LTPA is a mechanism used by WebSphere and other IBM products (e.g lotus products) as a means of authentication (typically for a Single Sign on SSO)
If a WebSphere App Server (as an example) authenticates a user and the request say goes to a lotus product (which is part of the same domain), the lotus product identifies the user via the LTPA token which was generated by WAS.
The same applies to multiple WebSphere products too.
There are no public APIs for LTPA for users to work with and it is meant to be used by various IBM products.
HTH
Manglu
我同意 Gary 的观点，即您可以选择不同的令牌来使用 WebSphere。您不必使用 LTPA。
但话虽如此......我有一个 我自己想出的问题和解答使用 IBM 工具与安全性进行通信。我们的视角是 Web 服务（特别是 JAX-WS），但我确信其中的一些原则仍然适用。在那篇文章中，我主要依赖于以下 developerworks 文章。
另外...不确定您是否可以考虑这一点，但有些产品可以为您进行令牌翻译。我工作的地方是一家 IBM 商店，而且往往会大量出血，所以我只知道 IBM 堆栈（这可能对您使用 WebSphere 有所帮助），但我确信还有其他产品和/或免费/开源项目你可以使用。 IBM 工具的一个示例是 IBM WebSphere DataPower 设备。我相信某些 IBM Tivoli 产品也可以在该领域提供帮助。
另外...根据我使用 LTPA 的经验。如果您不在容器（即 WebSphere 盒子）中运行，IBM 不会让您生成令牌。所以测试变得有点棘手。
我已经给了你一些继续下去的线索。希望其中之一有所帮助。
I agree with Gary that you could choose a different token to work with WebSphere. You don't HAVE to use LTPA.
But that being said....I have a Question and Answer I figured out on my own to communicate with security using IBM tooling. The perspective is web services (specifically JAX-WS) but I'm sure some of the principles carry over. With that post, I mostly relied on the following developerworks article.
Also...not sure if you can consider this, but there are products that do token translation for you. The place I works is an IBM shop and tends to bleed blue pretty heavy, so I only know of the IBM stack (which may help you with WebSphere), but I'm sure there are other products and/or free/open source projects you can use. An example with IBM tooling is the IBM WebSphere DataPower appliance. I believe some of the IBM Tivoli products can help in that area as well.
Also...from my experience with LTPA. IBM does not let you generate the tokens if you are not running in the container (ie, a WebSphere box). So testing gets a bit tricky.
I've given you a couple of leads to go on. Hopefully one of those helps.
我还没有找到有关生成 LTPA 令牌的文档。也许你可以从这段代码中找出你需要什么， https://github.com/Unicon/ltpa-bridge ，它生成 LTPA 令牌。
I have not found documentation about generating LTPA tokens. Maybe you can figure out what you need from this code, https://github.com/Unicon/ltpa-bridge, which generates LTPA tokens.
您可以使用配置了 DataPower Gateway 的 IBM API Connect 来根据给定的用户 ID 生成 Ltpa 令牌。
https:// www.ibm.com/support/knowledgecenter/en/SSMNED_5.0.0/com.ibm.apic.toolkit.doc/rapim_ref_ootb_policyltpagen.html
You could use IBM API Connect configured with DataPower Gateway to generate Ltpa tokens, given the userid.
https://www.ibm.com/support/knowledgecenter/en/SSMNED_5.0.0/com.ibm.apic.toolkit.doc/rapim_ref_ootb_policyltpagen.html