扩展WebSphere SAML Identity传播

Question

I have an existing financial application which uses an API gateway to authenticate web-based users. This gateway maintains a security session for the user, and proxies SOAP calls on to a WebSphere box. It adds a signed SAML assertion to these SOAP calls.

A series of JAX-WS Services are deployed on WebSphere, and these are protected with WebSphere policies to consume the SAML assertions. The identity and group memberships specified in the SAML assertions are then propagated to the WebSphere security context for the service call. All works very well, all of the security logic is done purely by configuration.

New requirements now require that we propagate the sessionId in the API gateway all the way through to WebSphere , and beyond. This is for reasons of traceability.

Clearly we could change the WSDL for all of the services to include some Meta-data fields, but this is a big change, and would require very extensive testing.

I was hoping there might be a way to map some arbitrary attributes from the SAML assertion (Other than Identity and groupMembership) to the WebSphere security context. Or even to access the SAML XML in the (authenticated) JAX-WS Service.

Has anyone done this?

Answer 1

You can have API gateway to add sessionid as an SAML attribute, then retrieve the attribute from Subject after SAML is processed by WebSphere. Here is sample code to get SAML attribute in WebSphere after SAML is processed.

    Subject subject = WSSubject.getRunAsSubject();


    SAMLToken samlToken = (SAMLToken) AccessController.doPrivileged(
                new java.security.PrivilegedExceptionAction() {
                    public Object run() throws java.lang.Exception
                    {
                        final java.util.Iterator authIterator = subject.getPrivateCredentials(SAMLToken.class).iterator();
                        if ( authIterator.hasNext() ) {
                            final SAMLToken token = (SAMLToken) authIterator.next();
                            return token;
                        }
                        return null;
                    }
                });

    Map<String, String> attributes = samlToken.getStringAttributes();
    List<SAMLAttribute>  attributes = samlToken.getSAMLAttributes();

Answer 2

Instead of looping through the creds yourself, you can use the WSSUtilFactory API to do it for you: https://www.ibm.com/support/knowledgecenter/SSAW57_9.0.0/com.ibm.websphere.javadoc.doc/web/apidocs/com/ibm/websphere/wssecurity/wssapi/WSSUtilFactory.html

Assuming that you are using a SAML 2.0 token, you can do:

WSSUtilFactory wssuf = WSSUtilFactory.getInstance();
SAMLToken token = wssuf.getSaml20Token();

The getSaml20Token method was added to WSSUtilFactory in 70043, 80013, 85510 and 9000.