Hi,

I have configured an STS-chain that I'm calling from the SP side towards the end of the SAML federation.

I only want the IDP to provide me with the username, I as an SP will look into my own LDAP and fetch group membership from my STS-chain.

I used the IBM Security Access Manager Federation Cookbook as a guide for this.

And I have made it work.

 

After SAML login, I can see that my groups are added to the credential, but they are added like this:

AZN_CUSTOM_ATTRIBUTES :  ibm-allgroups

ibm-allgroups : = cn=group1,o=blalbla,c=bla, cn=group2,o=blabla,c=bla, cn=group3,o=blabla,c=bla

This kind of formatting is not recognized in ISVA as group membership. For example, ISVA doesn't naturally include those groups inside the iv-creds.

Any tips on how I can add those groups in a more "natural" way so as they are included in the iv-creds?

My mapping rules are looking like this at the moment:

ip_pre_ldap

ip_post_ldap

And the attribute source I have created under Federation > Attribute source

Attribute name Groups

Value ibm-allgroups

Type LDAP

And the attribute mapping I'm doing inside the STS-chain:

Attribute Name ibm-allgroups

Attribute Source Groups

------------------------------
Jonatan Wålegård
------------------------------

@Scott Exton

Yes I want the groups to be added to the credential in a way that ISVA will send them to the backends inside iv-creds, and that we can also use ACLs,

Whenever I am looking into a credential in a working scenario, it looks like this:

AZN_CRED_GROUPS	[0] group1 [1] group2 [2] group3
	AZN_CRED_GROUP_REGISTRY_IDS	[0] cn=group1,o=blabla,c=bla [1] cn=group2,o=blabla,c=bla [2] cn=group3,o=blabla,c=bla
	AZN_CRED_GROUP_UUIDS	[0] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [1] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [2] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

I'm not sure I understand the PAC-approach. I just want to add some groups to the credential inside a SAML mapping rule (the correct way).

------------------------------
Jonatan Wålegård
------------------------------

Original Message:
Sent: Wed September 13, 2023 05:17 PM
From: Scott Exton
Subject: Adding groups to credential in SAML flow

Jonatan,

 

What are you trying to achieve?  Do you want the groups added to the credential as a multi-valued attribute, or are you wanting to populate the group field of the credential so that it can be used in ACLs and authorization decisions?

 

If you are after the former I would take a quick look at the following WebSEAL configuration entry: https://www.ibm.com/docs/en/sva/10.0.6?topic=stanza-eai-create-multi-valued-attributes.  This will however only work if the attributes are being sent back by AAC in different headers of the same name.

 

If you are after the later you would need to change your AAC configuration so that it returns a PAC (which is a complete credential) rather than individual headers.  The difference between the two options is that when a PAC is returned the credential is fully constructed and streamed back to WebSEAL by AAC.  When individual headers are returned WebSEAL constructs the credential from these headers.

 

I hope that this helps.

 

Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor

image002.png@01D85F83.85516C50">

 

 

 

Original Message:
Sent: 9/14/2023 2:56:00 AM
From: Jonatan Wålegård
Subject: RE: Adding groups to credential in SAML flow

@Scott Exton

Yes I want the groups to be added to the credential in a way that ISVA will send them to the backends inside iv-creds, and that we can also use ACLs,

Whenever I am looking into a credential in a working scenario, it looks like this:

AZN_CRED_GROUPS	[0] group1 [1] group2 [2] group3
	AZN_CRED_GROUP_REGISTRY_IDS	[0] cn=group1,o=blabla,c=bla [1] cn=group2,o=blabla,c=bla [2] cn=group3,o=blabla,c=bla
	AZN_CRED_GROUP_UUIDS	[0] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [1] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [2] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

I'm not sure I understand the PAC-approach. I just want to add some groups to the credential inside a SAML mapping rule (the correct way).

------------------------------
Jonatan Wålegård
------------------------------

Hi Jonatan,

In your ip_post_ldap mapping rule (when the ibm-allGroups is fetched by the Attribute Source), can you loop over the group DNs, and perform the equivalent of this:

group = new Group("testgroup2", "urn:ibm:names:ITFIM:5.1:accessmanager", null);
// TODO - revisit whether g1,g2 are needed pending defect 66726
g1 = new Attribute("registryid", "urn:ibm:names:ITFIM:5.1:accessmanager", "cn=testgroup2,dc=iswga");
g2 = new Attribute("uuid", "urn:ibm:names:ITFIM:5.1:accessmanager", "00000000-0000-0000-0000-000000000000");
group.setAttribute(g1);
group.setAttribute(g2);
stsuu.addGroup(group);

------------------------------
HANS VANDEWEGHE
------------------------------

Original Message:
Sent: Thu September 14, 2023 02:55 AM
From: Jonatan Wålegård
Subject: Adding groups to credential in SAML flow

@Scott Exton

Yes I want the groups to be added to the credential in a way that ISVA will send them to the backends inside iv-creds, and that we can also use ACLs,

Whenever I am looking into a credential in a working scenario, it looks like this:

AZN_CRED_GROUPS	[0] group1 [1] group2 [2] group3
	AZN_CRED_GROUP_REGISTRY_IDS	[0] cn=group1,o=blabla,c=bla [1] cn=group2,o=blabla,c=bla [2] cn=group3,o=blabla,c=bla
	AZN_CRED_GROUP_UUIDS	[0] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [1] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [2] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

I'm not sure I understand the PAC-approach. I just want to add some groups to the credential inside a SAML mapping rule (the correct way).

------------------------------
Jonatan Wålegård
------------------------------


Original Message:
Sent: Wed September 13, 2023 05:17 PM
From: Scott Exton
Subject: Adding groups to credential in SAML flow

Jonatan,

 

What are you trying to achieve?  Do you want the groups added to the credential as a multi-valued attribute, or are you wanting to populate the group field of the credential so that it can be used in ACLs and authorization decisions?

 

If you are after the former I would take a quick look at the following WebSEAL configuration entry: https://www.ibm.com/docs/en/sva/10.0.6?topic=stanza-eai-create-multi-valued-attributes.  This will however only work if the attributes are being sent back by AAC in different headers of the same name.

 

If you are after the later you would need to change your AAC configuration so that it returns a PAC (which is a complete credential) rather than individual headers.  The difference between the two options is that when a PAC is returned the credential is fully constructed and streamed back to WebSEAL by AAC.  When individual headers are returned WebSEAL constructs the credential from these headers.

 

I hope that this helps.

 

Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor

image002.png@01D85F83.85516C50">

 

 

 

I got some help from your colleague.

Sharing final solution:

var ibm-allgroups = stsuu.getAttributeContainer().getAttributeByName("ibm-allgroups");

if (ibm-allgroups != null){
var group_list = ibm-allgroups.getValues();
                for (var i=0; i<group_list.length; i++){
                                            var group_cn= group_list[i].substring(3,group_list[i].indexOf(","));
                                            var group = new Group(group_cn, "urn:ibm:names:ITFIM:5.1:accessmanager", null);                                                                                
                                            var g = new Attribute("registryid", "urn:ibm:names:ITFIM:5.1:accessmanager", group_list[i]);
                                group.setAttribute(g);
                                stsuu.addGroup(group);
                }              

}

------------------------------
Jonatan Wålegård
------------------------------

Original Message:
Sent: Thu September 14, 2023 03:35 AM
From: HANS VANDEWEGHE
Subject: Adding groups to credential in SAML flow

Hi Jonatan,

In your ip_post_ldap mapping rule (when the ibm-allGroups is fetched by the Attribute Source), can you loop over the group DNs, and perform the equivalent of this:

group = new Group("testgroup2", "urn:ibm:names:ITFIM:5.1:accessmanager", null);
// TODO - revisit whether g1,g2 are needed pending defect 66726
g1 = new Attribute("registryid", "urn:ibm:names:ITFIM:5.1:accessmanager", "cn=testgroup2,dc=iswga");
g2 = new Attribute("uuid", "urn:ibm:names:ITFIM:5.1:accessmanager", "00000000-0000-0000-0000-000000000000");
group.setAttribute(g1);
group.setAttribute(g2);
stsuu.addGroup(group);

------------------------------
HANS VANDEWEGHE
------------------------------


Original Message:
Sent: Thu September 14, 2023 02:55 AM
From: Jonatan Wålegård
Subject: Adding groups to credential in SAML flow

@Scott Exton

Yes I want the groups to be added to the credential in a way that ISVA will send them to the backends inside iv-creds, and that we can also use ACLs,

Whenever I am looking into a credential in a working scenario, it looks like this:

AZN_CRED_GROUPS	[0] group1 [1] group2 [2] group3
	AZN_CRED_GROUP_REGISTRY_IDS	[0] cn=group1,o=blabla,c=bla [1] cn=group2,o=blabla,c=bla [2] cn=group3,o=blabla,c=bla
	AZN_CRED_GROUP_UUIDS	[0] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [1] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx [2] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

I'm not sure I understand the PAC-approach. I just want to add some groups to the credential inside a SAML mapping rule (the correct way).

------------------------------
Jonatan Wålegård


Original Message:
Sent: Wed September 13, 2023 05:17 PM
From: Scott Exton
Subject: Adding groups to credential in SAML flow

Jonatan,

 

What are you trying to achieve?  Do you want the groups added to the credential as a multi-valued attribute, or are you wanting to populate the group field of the credential so that it can be used in ACLs and authorization decisions?

 

If you are after the former I would take a quick look at the following WebSEAL configuration entry: https://www.ibm.com/docs/en/sva/10.0.6?topic=stanza-eai-create-multi-valued-attributes.  This will however only work if the attributes are being sent back by AAC in different headers of the same name.

 

If you are after the later you would need to change your AAC configuration so that it returns a PAC (which is a complete credential) rather than individual headers.  The difference between the two options is that when a PAC is returned the credential is fully constructed and streamed back to WebSEAL by AAC.  When individual headers are returned WebSEAL constructs the credential from these headers.

 

I hope that this helps.

 

Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor

image002.png@01D85F83.85516C50">