Introduce some parameter to enable basic auth and OIDC(ADFS) be mixed.

Hi guys, I hope you are well.
We have third party authentication using OIDC (ADFS) feature in zCEE to access ADFS server. To do this we don’t use EJBROLES, only ALL_AUTHENTICATED_USERS.

I have to enable SAF to get access thru EJBROLES as well, So I’m trying to mix ADFS with BASIC. I introduced a SAF registry. I also introduced a filter in OIDC to isolate jwt users and I set fallback to basic as true.

With that configuration and as the ADFS user is not defined in ACF2/RACF, the APIs fail. The problem is: as soon as SAF is enabled a check is enforced to see if the distributed id is in ACF2/RACF registry. Our ADFS entities are not going to be defined in the ESM. So maybe an option like mapIdentityToRegistryUser="none" meaning “no registry (SAF) check” could be added. Also as you can see the mapIdentityToRegistryUser parameter description is confusing. It says “if false the registry is not used”. But it is indeed.

I worked with IBM in a case TS021322314 since Jan 30, but no solution was provided. THis prevents us to use some interesting tools needing EJBrole authorization.
Could you please analyze this enhancement?

Regards
Carlos

mapIdentityToRegistryUser: boolean false: Specifies whether to map the identity to a registry user. If this is set to false, then the user registry is not used to create the user subject.

Open Id client configuration

<openidConnectClient id="CoreApiClient"
inboundPropagation="required"
mapIdentityToRegistryUser="false" <-- this one
userIdentifier="JPMCIdentifier"
signatureAlgorithm="RS256"
jwkEndpointUrl="${idaKey}"
issuerIdentifier="${idaIss}"
audiences="${idaAud1},${idaAud2},${idaAud3},${idaAud4},${idaAud5}"
authFilterRef="jwtToken"
sslRef="defaultSSLConfig" >
</openidConnectClient>

<authFilter id="jwtToken">
<requestHeader matchType="contains" name="Authorization" value="Bearer "/>
</authFilter>