Configuring Single Sign-On using LTPA

This document details how to establish Single Sign-On (SSO) between HCL Connections and CEC for your HCL Connections Engagement Center (WebEngine) deployment. This process leverages Lightweight Third Party Authentication (LTPA) using shared LTPA keys and integrates with your existing Lightweight Directory Access Protocol (LDAP) server for user authentication.

Export LTPA keys from Connections

LTPA keys are generated by your Connections environment. These generated keys must be shared and configured within the Kubernetes cluster, as they are essential for enabling SSO via LTPA with CEC.

See the official IBM documentation, Exporting Lightweight Third Party Authentication keys, for detailed guidance on exporting these keys:

Create Kubernetes secret for LTPA keys

After exporting the LTPA keys from your Connections environment, you must make them available in your Kubernetes cluster as a secret. CEC is configured to import LTPA keys by referencing a Kubernetes secret containing two specific keys: ltpa.keys (the exported key file content) and password (the password used during key export).

Use the following kubectl command to generate this secret. Replace <ltpa_keys_path> with the actual path to your exported LTPA keys file, and <ltpa_keys_password> with the password you specified while exporting the LTPA keys from WebSphere.

kubectl -n connections create secret generic dx-web-engine-ltpa-secret \
    --from-file=ltpa.keys=<ltpa_keys_path> \
    --from-literal=password=<ltpa_keys_password>

Configure CEC Helm chart for SSO

After creating the Kubernetes secret, configure the CEC Helm chart to use the LTPA keys and enable SSO. See Installation > SSO Configuration for detailed Helm values.yaml configuration.