Can anybody explain me how to get LTPA Token for each user. Basicall I want a particular user to login once and then be able to view applications on all the servers.
TIA,
Ki
Subject: LTPA Token
Tony:
did you create the SSO document in the Notes NAB? Also, is this a standalone Notes server or do you have another system like Websphere on it? As for the token, once the SSO has been created, it should, if all configurations to the other servers have been made correctly, the token is created.
Subject: RE: LTPA Token
Thanks for your reply. Where do I create that in NAB. Can you guide me with that. And once created does it create a token for each user. First Im trying to connect to different domino servers but the goal is to connect to them via Oracle 10g portal.
Ki
Subject: RE: LTPA Token
The Web SSO configuration document is a domain-wide configuration document stored in the Domino Directory. This document, which should be replicated to all servers participating in the single sign-on domain, is encrypted for participating servers and administrators, and contains a shared secret key used by servers for authenticating user credentials. To create a Web SSO configuration document if you are using Internet Sites
You should have already created a Web Site document, and enabled the use of Internet Site documents in the Server document.
Also be sure that your client location document has the home/mail server set to a server in the same domain as the servers participating in SSO. This ensures that all public keys for participating server can be found when the SSO document is encrypted.
-
In the Domino Administrator, click Files, and open the server’s Address Book (NAMES.NSF).
-
Select the Internet Sites view.
-
Click Create Web SSO Configuration.
-
In the document, click Keys.
-
Initialize the Web SSO Configuration with the shared secret key in one of two ways:
Choose Domino only (no WebSphere servers participating in single sign-on), and then select “Create Domino SSO Key.”
Choose Domino and WebSphere (single sign-on with WebSphere), and then do the following:
Select “Import WebSphere LTPA Keys.”
Browse and select the WebSphere LTPA export file. (See WebSphere documentation for details about generating ltpatoken keys.)
Enter the password (specified when generating the keys in WebSphere). The document is updated to reflect the information in the export file.
- Complete the rest of the document as follows: Field Action
Configuration Name Enter the name of the SSO configuration.
Note If the single sign-on configuration includes both Domino 6 and Release 5.0x servers, the Configuration Name must be LtpaToken, as Release 5.0x servers only work with this configuration name.
Organization Name (Required) Enter the name of the organization. This must match the organization name for the corresponding Web site. The SSO document will then appear in the Internet sites view, along with the Web Sites documents.
DNS Domain (Required) Enter the DNS domain (for example – lotus.com) for which the tokens will be generated. The servers enabled for single sign-on must all belong to the same DNS domain.
Domino Server Names Enter the names of the servers that will be participating in single sign-on (for example – server1/acme, server2/acme). This document will be encrypted for the creator of the document, the members of the Owners and Administrators fields, and the servers specified in the Domino Server Names field.
Groups, wildcards, and the names of WebSphere servers are not allowed in this field. Only Domino servers can be listed as participating servers in the Server Names field.
Note There is a 64K-size limit on this field. An error message appears when the limit is reached, such as when the names of several hundreds of servers are entered. It is recommended that you create more than one Web SSO Document if this limit is reached.
Expiration (minutes) Specify the time period, in minutes, for which the token will be valid. This time period begins at the time the token is issued. The token is valid for only the number of minutes specified; it does not expire based on inactivity. Default is 30 minutes.
- Save the Web SSO Configuration document. A message on the status bar indicates the number of servers/people for whom the document was encrypted. The document(s) will appear in the Internet Sites view.
To create a Web SSO configuration document if you are using the Web Server Configurations view
Use this procedure to create a Web SSO configuration document if your server is a Release 5.0x server, or if you are using Domino 6 but you do not use Web Site documents to manage your Web sites.
-
In the Domino Administrator, click Files, and open the server’s Address Book (NAMES.NSF).
-
Select the Servers view.
-
Click Create Web SSO Configuration.
-
In the Web SSO Configuration document, click Keys.
-
Initialize the Web SSO Configuration with the shared secret key in one of two ways:
Choose Domino only (no WebSphere servers participating in single sign-on), and then select “Create Domino SSO Key.”
Choose Domino and WebSphere (single sign-on with WebSphere), and then do the following:
Select “Import WebSphere LTPA Keys.”
Browse and select the WebSphere LTPA export file. (See WebSphere documentation for details about generating ltpatoken keys.)
Enter the password (specified when generating the keys in WebSphere). The document is updated to reflect the information in the export file.
- Complete the rest of the document as follows: Field Action
Configuration Name Enter the name of the SSO configuration.
Note If the single sign-on configuration includes both Domino 6 and Release 5.0x servers, the Configuration Name must be LtpaToken, as Release 5.0x servers only work with this configuration name.
Organization Name Leave this field blank, and this document will appear in the Web Configurations view.
DNS Domain (Required) Enter the DNS domain (for example, lotus.com) for which the tokens will be generated. The servers enabled for single sign-on must all belong to the same DNS domain.
Domino Server Names Enter the names of the servers that will be participating in single sign-on (for example – server1/acme, server2/acme). This document will be encrypted for the creator of the document, the members of the Owners and Administrators fields, and the servers specified in the Domino Server Names field.
Note Groups, wildcards, and the names of WebSphere servers are not allowed in this field. Only Domino Servers can be listed as participating servers in the Server Names field.
Expiration (minutes) Specify the time period, in minutes, for which the token will be valid. This time period begins at the time the token is issued. The token is valid for only the number of minutes specified; it does not expire based on inactivity. Default is 30 minutes.
- Save the Web SSO Configuration document. A message on the status bar indicates the number of servers/people for whom the document was encrypted. The document(s) will appear in the Web Server Configurations view.
Note If you receive messages on the client indicating that a particular key was not found for encrypting the document, you may have to change your client’s location document to point to a different mail/directory server that will have all the public keys included in server and person documents.
To confirm that users are being assigned tokens:
In the address bar of the browser, type in:
javascript:window.alert(document.cookie)
If the token was assigned, you will see its configuration in the window that pops up.
If cookies are enabled and the token is not assigned, you will just get a window that says “CookieTest=ON”
Subject: RE: LTPA Token
Thanks for your detailed response Andrew. Just one question. Do I need to pass this LPTA Token for each user for SSO, if yes how do I do that. If not how will SSO work.
Ki
Subject: RE: LTPA Token
Hey Tony, No problem. I think you will find alot of your answers in the Domino Administrator help. Do a search in the help on:
sso document
That should lead you in the right direction.
Subject: Ignore this post
Subject: RE: LTPA Token
To create the document, go to the server NAB, “Servers” view and you “should” see a view action called “Web”. It should be the last action in dropdown of actions. Just fill in the fields as it applies to you needs :).
Subject: RE: LTPA Token
One last thing. Can I use this LTPA Token to give access to each user. Any ideas or example would be very helpful.
Thanks alot,
Ki