IBM WebSphere interserver authentication: LTPA and SSL

On some applications, if you have a two layer deployment, one server for the web layer and another server for the business logic layer, you may need to enable global security and then to allow the communication between servers you need to setup LTPA between servers. On version 5.x and 6.0 just by moving the LTPA key from the business server to the application server and setting up the authentication method does the deal, and it has no need of intermediate steps to allow communication between servers.

On 6.1 version is not quite that simple, because RMI between servers runs now over SSL, and guess what if an SSL session can’t be established, the comunication is not possible.

The error message might be something like: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_CLIENT_SOCKET: JSSL0080E: javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of security. Reason: com.ibm.jsse2.util.h: No trusted certificate found vmcid: IBM minor code: E07 completed: No]

The key lead here is the “No trusted certificate found”, which means that an SSL session could not be established do too the missing of a server certificate.

The solution: On the IBM Websphere server that needs to comunicate (in this case the server running the the web layer), execute the following steps:

1) Logon into the WAS console.

2) Goto Security -> SSL and Key Management

3) Select the NodeDefaultTrustStore and then Signer Certificates

4) Define your parameters, where the main issue is that the host must be the server you which to connect and the port is 9043.

5) Just give an alias name and press the button “Retrieve Signer Certificate”

6) Press apply and OK, and you’re done.

Try connecting again. It should work now.

Disable auto-generation of LTPA Keys

In a sso-enviroment this option could be a source of problems.
Websphere is configured by default to automatically generate new LTPA Keys every 12 weeks.
This caused some problems in our sso-enviroment.
Here is an link to this issue:
http://publib.boulder.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_ssldisableltpakeygen.html

here another one (PPT):
http://www-1.ibm.com/support/docview.wss?uid=swg27011781&aid=1

Hint:
backup your config-directory.
LTPA-Keys are stored in this file
/"websphere"/"dmgr"/config/cells/"cellname"/ltpa.jceks

Export / Import LTPA-Keys for Single Sign On (SSO)

Sometimes its necessary to implement an SSO-Enviroment over different WebSphere-Cells (e.g. Production-Cell and Acceptance-Cell). To do this both cells need the same LTPA-Keys.
The synchronization of LTPA-Keys can be done over Admin-Console.

1. To Export LTPA-Keys from a Cell navigate to
Security > Secure administration, applications, and infrastructure > Authentication mechanisms and expiration.

2. Fill out the import/export-Form at the bottom of the pageand click "Export keys". The LTPA-Keys will be exported to the specified directory. (The Keys will be password protected.)

3. Copy the exported ltpa.jceks-File to other the Cell (do not override ltpa.jceks of this cell).

4. Take a look at ltpa.jceks-File of this cell and note the file-size.
File is located in /"websphere"/"dmgr"/config/cells/"cellname"/ltpa.jceks

5. To import the LTPA-Keys to other Cell navigate to
Security > Secure administration, applications, and infrastructure > Authentication mechanisms and expiration.

6. Fill out "Cross-cell Single sign on"-From and click "Import keys"

7. File size of ltpa.jceks-File of this Cell should now be increased.
Sometimes nothing happens to file size of ltpa.jceks-File and Cross-cell SSO will not work (WAS-Bug).
In this case just repeat the import.

8. Restart servers/node