I cannot answer specifically on the JBoss capability, but I do know a bit about LTPA. LTPA is an IBM proprietary SSO token, but its really quite simple. All it does is take the user identity (maybe a bit more), encrypt it and pass it in a session cookie. So this just means that the two servers need to:
- be on the same domain
- share a secret (encyption key)
- share an identity store (e.g LDAP)
I have used it before to SSO between IBM Websphere AppServers and PortalServers. It's easy enough to setup on the IBM side I'm sure and I think it would be feasible to use it on a non-IBM product (again I need to defer to someone else to comment on whether JBoss supports this).
Would the user authenticate on the Domino server or the JBoss server? That would just drive whether you expect JBoss to create LTPA tokens or just be able to read them.
In terms of an architecture I don't see any reason why you couldn't do it. I'm not entirely sure whether IBM will not go and change the way it works on you. In other words I don't know if they intend for you to use it outside of their products, so they may one day decide to change the way it is created.
LTPA is an IBM proprietary token. I do not think they intend it to be used in any manner (CRUD) outside of their ecosystem. There are ways by we are able to obtain a SAML2 token as a replacement for the LTPA token from IBM security services. But I cannot go over them in the forums. If you desire, you will have to contact our sales or consulting.
thanks a lot for your answers.
It's a tricky subject, even if I'm sure LTPA token could be handle through a WebApp deployed on JBoss AS.
But as you underlined it, LTPA is an IBM proprietary token, so...
Regarding the complexity and our schedule, this subject was finally put in brackets yesterday.
SAMLv2 was my first option too, and I hope I could handle these tokens in my next project.
Thanks for your help.