PM51996: ADD SAML 2.0 WEB BROWSER SSO PROFILE SUPPORT

Fixes are available

APAR status

Closed as new function.

Error description

Add SAML 2.0 Web Browser SSO Profile support

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server.                                     *
****************************************************************
* PROBLEM DESCRIPTION: WebSphere Application Server does not   *
*                      have SAML 2.0 Web Browser               *
*                      SSO capability.                         *
****************************************************************
* RECOMMENDATION:  Install a fix pack that includes this APAR  *
*                  and follow Information Center instructions  *
*                  to configure the feature. Due to the large  *
*                  size of this update, interim fixes cannot   *
*                  be created.                                 *
****************************************************************
Security Assertion Markup Language (SAML) is an OASIS open
standard for representing and exchanging user identity,
authentication, and attribute information. SAML is fast
becoming
the technology of choice to provide cross-vendor single sign-on
(SSO) interoperability.
SAML 2.0 Web Browser SSO Profile is defined to support web
single sign-on.
Exerpt from "Profiles for the OASIS Security
Assertion Markup Language (SAML) V2.0", OASIS Standard, 15
March 2005:
"In the scenario supported by the web browser SSO profile, a
web user either accesses a resource at a service provider,
or accesses an identity provider such that the service
provider and desired resource are understood or implicit. The
web user authenticates to an identity provider, which then
produces an authentication assertion, and the service provider
consumes the assertion to establish a security context for the
web user."

Problem conclusion

This APAR adds new function to WebSphere Application Server to
support IdP initiated SAML web SSO.

The WebSphere Application Server SAML service provider (SP)
supports SAML 2.0 Identity Provider (IdP) initiated single
sign-on (SSO). WebSphere IdP initiated SSO service is
implemented as a Trust Association Interceptor (TAI) and the
sequence flow can be decribed as follows:

   1. A user accesses a front end web application that can
reside on an IdP, SP, or elsewhere.
   2. A front-end web application redirects the user to the IdP
and the user authenticates to the IdP.
   3. The IdP redirects the user to the Assertion Consumer
Service (ACS) in the SP by sending a SAML response over an HTTP
POST inside a hidden form.
   4. The SP processes the SAML response and creates a
WebSphere security context.
   5. The SP adds an LTPA cookie to HTTP response and
redirects the HTTP request to a web resource or business
application.
   6. The WebSphere Application Server intercepts the request,
and maps the LTPA cookie to a security context and authorizes
the user to access the requested web resource.
   7. The WebSphere Application Server sends an HTTP response
back to the user.

Highlights of the SAML Web SSO feature:

    * The WebSphere SAML service provider supports single
sign-on with multiple identity providers.
    * The WebSphere SAML service provider supports options for
identity assertion and mapping the assertion identity to the
user registry of the service provider.
    * The WebSphere SAML service provider provides a plug
point to allow for customized identity mapping.
    * The WebSphere SAML service provider preserves the SAML
token in the subject of the service provider for access by the
application, and makes it available for a downstream
authenticated Enterprise JavaBean (EJB) or Web Service call.
    * The WebSphere SAML service provider allows a business
application URL to act as an AssertionConsumerService URL, so
the IdP can send a SAMLResponse directly to the business
application URL.
    * The WebSphere SAML TAI allows auditing of key SAML
assertions, including Issuer and NameID.

More information about about the WebSphere SAML 2.0 Web Browser
SSO feature can be found in the Information center.

Due to the large size of this update, it will only be
available via a fix pack; interim fixes cannot be created.

The fix for this APAR is currently targeted for inclusion in
fix pack 7.0.0.23 and 8.0.0.4.  Please refer to the
Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Keywords: IBMWL3WSS, SAMLWSSO

Temporary fix

Comments

APAR Information

APAR number
PM51996
Reported component name
WEBSPHERE APP S
Reported component ID
5724J0800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2011-11-10
Closed date
2012-05-07
Last modified date
2015-09-09

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE APP S
Fixed component ID
5724J0800

Applicable component levels

R700 PSY
UP
R800 PSY
UP
R850 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
28 October 2021

Tips

PM51996: ADD SAML 2.0 WEB BROWSER SSO PROFILE SUPPORT

Fixes are available

Subscribe

APAR status

Closed as new function.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

R800 PSY

R850 PSY

Document Information

Share your feedback

Need support?