CICS SAML support - scenario 3 - create a SAML assertion

1. Channel services sends SOAP request message to CICS
2. SSL server authentication between channel services and CICS
3. CICS provider pipeline authenticates service requester (using mechanism other than SAML)
RACF user id is associated with Inbound DCR task
4. DPL to AOR to run target business logic program
5. DPL to Outbound DCR for outbound service call (INVOKE SERVICE)
6. Application or custom message handler creates SAML assertion containers including identity and entitlements.
REMARK (March 1st): The identity set for the outbound SAML assertion will depend on whether the CICS task has been initiated by a real user or automatically by another system. <MR> We are considering situtions where we have user initiated requests (some human being sat at a device interacting with HSBC) and ‘headless' requests – things just happen usually related to some external or timed event. For example, we have integration between batch and CICS. We have diarised processing that takes place at an appointed date/time or after an interval expires following the last time time we did this. We have background transactions that are polling something (e.g. MQ Q, TSQ, DB2 table etc…) that runs periodically to mop up any work accumulated since the last time it ran. Etc… So if we do have the identity of a human being, we'd want to use that. If we don't and all we have is what's available from the environment – e.g. CICS region name, transaction id etc… - we'd have no option but to fabricate an ‘id' for the purposes of the SAML </MR>
7. CICS requester pipeline security processing signs SAML token with CICS region's private key and attaches as WS-Sec header to SOAP request message
REMARK (March 1st): A RACF keystore is the most likely implementation for storing certificates.
REMARK (March 1st): The X.509 certificate containing the CICS public key is sent with the message. <MR> our interpretation of WS-SEC means we intend to send the X509 with every message. We should confirm that is still the case with our colleagues in IT & Security though – the collective thinking may have moved on since the last time I saw a sample message.
8. SSL server authentication between CICS and channel services