Ceptor contendsCeptor support authenticating users using LTPA Tokens, and can also issue new LTPA Tokens to use as cookies to backend servers, thus enabling easy SSO with IBM products.
...
| Name | Value | Description | ||
|---|---|---|---|---|
| ltpa.tokens | List of token names, separated by comma or semicolon | List of token names to load - allows you to specify multiple different tokens which each use their own set of keys | ||
| ltpa.token.default.name | String | Name of token that will be used as default, if nothing else is indicated in the call. Note that if only one token is configured, that token name will be used as default so in that case this does not need to be specified. | ||
| For the following <tokenname> is replaced with the name of the token | ||||
| ltpa.token.<tokenname>.authenticate | true/false | Set to true if authentication is allowed with this token - if false, LTPA tokens can be created for this, but authentication using such a token is not allowed. | ||
| ltpa.token.<tokenname>.filename | String containing filename, macros are allowed. | Specify a filename to load properties from - if not specified, If properties are not specified, and the file this points to does not exist, a new one will be generated with new keys. Note that this file must be kept the same across all clusters and kept in sync with all servers consuming the LTPA keys. | ||
| ltpa.token.<tokenname>.properties | Contens Contents of LTPA key file | If specified, contains the contends contents of the key file - this key is in the format generated by the various IBM products. Example:
You can use this property to keep the keys in Ceptor's configuration instead of having them on disk on all servers within a cluster. Note that the keys are encrypted with the password. | ||
| ltpa.token.<tokenname>.password | Password - may be encrypted. | Specify the password that the keys are encrypted with - see Encrypting or Obfuscating Passwords for details on keeping the password safe. | ||
| ltpa.token.<tokenname>.create.userid | Mapper - used to specify userid in created tokens. Default: user:BasicRegistry/%{userid} | This mapper is used to specify the userid in a created token. The macro %{userid} will be replaced with the authenticated users userid, and %{xxxxx} will be replaced by any other input specified when calling the newToken() method on the authentication plugin. This can also be a script (javascript / groovy / python) which generated and returns the value to use. | ||
| ltpa.token.<tokenname>.expiration.minutes | Long | Token expiration time in minutes - newly created tokens will expires after the configured number of minutes. Tokens created by the | ||
| ltpa.token.<tokenname>.create.script | Script | This script is called when creating new tokens - it allows adding additional attributes to the token, such as the users groups, name or anything else you want to add to the token itself. | ||
| ltpa.token.<tokenname>.parse.script | Script | Called when parsing the token - it allows you to specify which attributes are mapped to what within the session. | ||
...