title: 'Disabling' LTPA things in a Liberty server - am I missing something?
body: <p>I am investigating the notion of 'disabling' LTPA things in Liberty and would like some guidance. There are 2 ideas I am pursuing - first, is it possible to prevent a Liberty server from generating LTPA keys? and second, is it possible to prevent a Liberty server from sending an LTPA token/cookie to a client browser?</p>
  
  <p>Before making this post, I went through the Liberty documentation. This topic in the Liberty KC <a href="https://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.wlp.doc/ae/twlp_sec_ltpa.html" rel="nofollow noreferrer">https://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.wlp.doc/ae/twlp_sec_ltpa.html</a> states the following - "The LTPA is configured by default when security is enabled for a Liberty server for the first time." This is pretty clear that as long as I have security enabled for a Liberty server, it is going to generate LTPA keys; and disabling security in the Liberty server is not an option for me. So I do not believe that I can prevent the Liberty server from generating LTPA keys in my particular environment.</p>
  
  <p>As for preventing a Liberty server from sending an LTPA token/cookie to a client browser, there appears to be an attribute called disableLtpaCookie that exists for a Liberty server. However, according to the Liberty documentation, I can use the disableLtpaCookie attribute in only 2 cases - when I am using the OpenID Connect Client <a href="https://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.liberty.autogen.base.doc/ae/rwlp_config_openidConnectClient.html" rel="nofollow noreferrer">https://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.liberty.autogen.base.doc/ae/rwlp_config_openidConnectClient.html</a> OR when I am using SAML Web SSO 2.0 Authentication <a href="https://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.liberty.autogen.base.doc/ae/rwlp_config_samlWebSso20.html" rel="nofollow noreferrer">https://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.liberty.autogen.base.doc/ae/rwlp_config_samlWebSso20.html</a> . If I am not implementing either of these authentication mechanisms, then I cannot use the disableLtpaCookie attribute...and thus I cannot prevent a Liberty server from sending an LTPA token/cookie to a client browser.</p>
  
  <p>Am I missing something? Is there a way to prevent a Liberty server from generating LTPA keys or a way to prevent a Liberty server from sending an LTPA token/cookie to a client browser that I have not yet discovered through the Liberty documentation?</p>
  
  <p>Any and all guidance is deeply appreciated and thank you in advance!</p>