CICS SAML support - scenario 1 - validate SAML

Service consumer authenticates with gateway

Gateway creates SAML token containing consumer's identity.

Gateway signs token with gateway's private key and sends to channel services in HTTP header.

Channel services asserts SAML token by inserting it into SOAP WS-Sec header

REMARK: All SAML tokens destined for CICS flow as a WS-Sec header in a SOAP message

REMARK (March 1st): SAML support is required for SOAP over HTTP(S) and MQ.

SSL server authentication between channel services and CICS.

REMARK: Server side SSL/TLS will be used initially

REMARK (March 1st): In the majority of cases for SOAP over HTTP, using HTTP over TLS with mutual authentication provides better protection against ‘man in the middle' attacks.

CICS provider pipeline security processing optionally validates the assertion. Validation consists of:

Checking that the token is ‘alive' (check timestamp)

Validate the public key supplied in the assertion against the registered key store for the key owner – the <SAML2:Issuer>

Validate the signature

Perform a OneTimeUse check

REMARK (March 1st): A RACF keystore is the most likely implementation for storing certificates.

CICS then extracts the contents of the SAML token into a set of SAML assertion containers so that an application can extract information from the SAML assertion.

REMARK: Support is required for signed and unsigned SAML tokens

REMARK: The expectation is that signature validation will be an expensive process. It may be more efficient to validate the signature before the request arrives in CICS.

OPEN Q: What attributes of the assertion need to be parsed and extracted into containers? (Subject, conditions, attributes …) <MR> TBC but initial thoughts are that we may need to apply processing logic to various segments of the assertion </MR>