The Liberty profile server uses a user registry to authenticate a user and retrieve information about users and groups to perform security-related operations, including authentication and authorization.
About this task
To learn about how authentication works in the Liberty profile, see Liberty profile: Authentication.
The authentication tasks that you can configure might vary depending on your requirements. Unless you have used the quickStartSecurity element that can configure only one user, you have to configure the user registry at the least. You do not have to configure the values for JAAS, authentication Cache and SSO tasks unless you want to change the default values. Configure TAI configuration only when you have an implementation of TAI interface to handle authentication.
Subtopics
- Configuring a user registry for the Liberty profile
You can store user and group information for authentication in several types of registry. For example you can use a basic user registry, or an LDAP registry.
Optionally,
you can configure two or more LDAP registries so that the operations
are executed on all the configured registries. For example, when you
perform an operation of searching a user, the search is performed
on all the configured LDAP registries. - Configuring the authentication cache on the Liberty profile
You can modify how authenticated users are cached on the Liberty profile. - Configuring a JAAS custom login module for the Liberty profile
You can configure a custom Java™ Authentication and Authorization Service (JAAS) login module before or after you have configured the Liberty profile server login module. - Configuring LTPA on the Liberty profile
You can configure a Liberty profile server to use a specific Lightweight Third Party Authentication (LTPA) keys file, user-defined password, and expiration time. - Customizing SSO configuration using LTPA cookies for the Liberty profile
With single sign-on (SSO) configuration support, web users can authenticate once when accessing Liberty profile resources such as HTML, JavaServer Pages (JSP) files, and servlets, or accessing resources in multiple Liberty profile servers that share the same Lightweight Third Party Authentication (LTPA) keys. - Configuring RunAs authentication in the Liberty profile
You can delegate authentication to another identity by configuring the RunAs specification for the Liberty profile. - Configuring TAI for the Liberty profile
You can configure the Liberty profile to integrate with a third-party security service using Trust Association Interceptors (TAI). The TAI can be called before or after single sign-on (SSO).
Task topic