IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  LTPA token issue

    Posted Fri April 22, 2022 09:28 AM
    Hi,
    I'm currently facing a strange issue with LTPA token...

    The value used to generate the token is supposed to be taken from
    AZN_CRED_REGISTRY_ID but this seems not working anymore (ISVA10.0.3.1)

    I'm trying to substitute the identity of a user defined in a federated directory on ISAM with the one defined into another LDAP on WAS level.(other path)

    Does anyone already face this issue? or how can I do this?

    eg:
     context.set(Scope.SESSION, 'urn:ibm:security:asf:response:token:attributes', 'AZN_CRED_REGISTRY_ID', 'cn=' + user + ',ou=users,o=XXXX,c=XX');

    Thanks in advance for your help




    ------------------------------
    Michael Erkens
    ------------------------------


  • 2.  RE: LTPA token issue

    Posted Fri April 29, 2022 05:23 AM
    Hi Michael,

    the way I do this is by using a TFIM:SSO junction with an STS chain.

    var principalName = stsuu.getPrincipalName();
    stsuu.getPrincipalAttributeContainer().clear();

    // TODO: this is a hardcoded technical user.
    stsuu.addPrincipalAttribute(new Attribute("name", "urn:ibm:names:ITFIM:ltpa", "CN=yourotheruser,ou=users,o=XXXX,c=XX"));



    This approach does not change the credential of the logged in user in ISAM, but allows to modify the LTPA token.
    It does require the federation module, though.



    ------------------------------
    Tom Bosmans
    ------------------------------

    Original Message


  • 3.  RE: LTPA token issue

    Posted Tue May 03, 2022 02:12 AM
    Hi Tom,
    thanks for the tip, I'll try this solution if no other option...

    ------------------------------
    Michael Erkens
    ------------------------------

    Original Message


Related Content