Make it easy for customers to find ssoRequiresSSL flag

[una-tapa]

This issue comes from our support team serviceability initiative.

One of the frequently asked questions from customers is "what flag to set to secure the LTPA cookie in Liberty env?"

Although the information can be found in the stackovervlow,
https://stackoverflow.com/questions/49119765/securing-ltpa-token-in-websphere-liberty-profile

Adding <webAppSecurity ssoRequiresSSL="true"/> to the server.xml file should do it.

[dmuelle]

We have this documented in OL under Server configuration security hardening: Best practices and network hardening: LTPA best practices. I will links to it to Single sign-on (SSO):LTPA and the LTPA examples on the apSecurity feature page

[dmuelle]

Hi @una-tapa - I added links to our existing LTPA best practices info, which includes the ssoRequiresSSL="true" setting, to the LTPA section of the single sign on page and the LTPA examples on the App Security feature page. WL updates are handled in a separate issue. If any further edits are needed for the Open Liberty docs, just let me know. Thanks!