propagate end user identity in an SOA environment build on DataPower when calling IMS Connect to invoke IMS transactions

Need to propagate original network ID of end user through SOA ESB to IMS for logging / audit purpose. Original Network ID may be Active Directory, SAML, OAUTH, X.509, etc.. Passing through SOA ESB implemented with DataPower XI50b that ID may be translated to a SAML token, a RACF id, ICRX token or pass phrase used by IMS to authenticate and authorize the request. We need the original identity of the user carried along for inclusion in log records or for use by the application. Our preference is to not have an individual RACF id that corresponds to Jane's AD ID. This forces us to synchronize passwords between AD and RACF which we would like to avoid as it introduces additional complexity and/or latency into process.

We also need that original identity propagated when IMS itself makes a call, whether to other z/OS systems such as CICS or back to the DataPower ESB even if the authorizing credentials in the outbound request are, as above, a certificate or token that does not identify the original requester.

Another reason to not rely on a RACF ID to pair with every AD ID is that on outbound calls from IMS the receiving system may not use a RACF ID for authorization or authentication and may require another type of security token from the one used between DataPower and IMS Connect.