LTPA Token in Tomcat (Spring security)

Question

I need to create a sso(Single Sign On) based on the LTPA, is there a way to use the tomcat server to accept the LTPA token or the spring security can decrypt the LTPA token and authorize the user. And I have probably searched everywhere, However there is no solution,

How can i configure spring security to use WebSphere LTPA authentication? Once spring security and LTPA have authenticated, how can i set/get the LTPA token in/from cookie?

Thanks in advance.

Answer 1

I am sorry, but IBM does not provide any public libraries for LTPA encryption / decryption.

Answer 2

If this is brower web application, you can set up WebSphere Liberty as OpenID Connect provider, and setup Tomcat as OpenId Connect client. When unauthenticated user access Tomcat, Tomcat redirects user to Liberty OIDC sever for authentication. The Liberty server will verify the LTPA cookie, and return standard OIDC token to Tomcat. So Tomcat will work with its own token/cookie, and relies on Liberty to verify ltpa cookie and receive standard compliant OIDC tokens