MQSeries.net :: View topic - Mulitple Identities, SOAPInput nodes and policy sets

bielesibub · Posted: Fri May 06, 2011 4:09 am Post subject:

Hi all,

Wonder if any of you guys have had need to deal with multiple identities within the same SOAP message.

A requirement that I'm current banging my head against a wall with goes something like this;

SOAP messages will be protected in the following ways, Kerberos, x509, and SAML2.0. Kerberos is used for user identity+signing, x509 for application identity(+signing(if not already signed)), and SAML2.0 purely for identity that is passed between flows/services.

In the case of identity authentication this is relatively easy, we can accept a request message without any security policy applied to it and extract the id token and dump it into a securityPEP node.

The problem occurs when we want to validate the integrity of a message using a policy.

If we are checking a message that has only one identity all is great, the message is verified and the identity extracted and passed through in the environment.

If we pass in a message that has multiple identities, it looks like the LAST (not the first as the documentation says) identity that matches the policy is taken, verified and passed through in the environment, while all the other identities are lost.

Is there a way to preserve this information? The only way that I can see to preserve this is to not enforce the policy in the SOAPInput node, but cobble some form of security management in a JAVACompute node - or alternatively use WAS (providing the security manager here doesn't throw away the details) as the front for all webservices.

Cheers,