On WebSEAL, we can create a junction and specify to use ltpa token.
What is the lifetime of the token is installed by default ?
Is it possible to change the token lifetime?

------------------------------
Igor Vinogradov
------------------------------

Igor,

There  are two ways that WebSEAL might generate an LTPA token:
  1) To send to a backend server
  2) To return to the browser

I'm not sure how the lifetime is set for (1).  In some ways, this lifetime isn't really important because it is always immediately consumed by the target server (usually WAS).  This cookie does not go to the client - the client session is maintained by WebSEAL (and this has its own session lifetime controlled by session cache configuration).

For (2) the lifetime is, by default, the WebSEAL session lifetime.  There are configuration parameters to refresh this cookie on a periodic basis to keep it fresh (although there is some performance overhead for this).   Check out this page in the product docs:
https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/wrp_config/concept/con_cntrl_ltpa_token_lifetime.html

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------