Configuring Principal Propagation (SAML)

You can configure principal propagation based on Security Assertion Markup Language (SAML).

If you configure principal propagation based on SAML (version SAML 1.1), the user is authenticated based on a trust relationship. A password is required because the receiver system trusts the sender system using certificates and names.

Principal propagation based on the SAML 1.1 standard is supported for Web service runtime.

Prerequisites

For inbound and outbound processing on the Integration Server, use a communication channel to connect to the Web service runtime (default: Web Services Reliable Messaging; communication channel: adapter type WS).

Procedure

1. Configuring Back-End Systems Involved

Define trust relationships between the back-end systems involved and execute the further configuration steps that are required in those back-end systems.

For more information, see: Configuring SSO with SAML Token Profiles

2. Configuring in the Integration Directory

In the Integration Directory use the following steps to specify between which entities principal propagation is to take place.

If you would like principal propagation to occur between a sender system and a receiver system using the Integration Server, perform the following steps:

Configure a business system each for the sender and receiver.
For more information, see: Configuring Business Systems
Implement principal propagation from the sender to the Integration Server.

Caution

Note that you must use a communication channel with adapter type WS for inbound message processing with the Integration Server.

End of the caution.

Follow these steps.
1. Configure the sender channel.
  Choose adapter type WS and the Sender radio button.
  
  Implement the following authentication method to configure the channel (under Security Settings):
  
  SAML 1.1 Sender Vouches Assertion (Message Authentication)
  
  Implement further channel attributes.
  
  For more information, see: Configuring the Communication Channel with Adapter Type WS
2. Create a sender agreement for the sender system and the outbound interface and assign the communication channel that you defined in the previous step to the sender agreement.
  For more information, see: Defining Sender Agreements
3. Activate the configuration objects.
Implement principal propagation from the Integration Server to the receiver.

Caution

Note that you must use a communication channel with adapter type WS for outbound message processing with the Integration Server.

End of the caution.

Follow these steps.
1. Choose adapter type WS and the Receiver radio button.
  Implement the following authentication method to configure the channel (under Security Settings):
  
  SAML 1.1 Sender Vouches Assertion (Message Authentication)
  
  Implement further channel attributes.
  
  For more information, see: Configuring the Communication Channel with Adapter Type WS
2. Create a receiver agreement for the receiver system and the inbound interface and assign the communication channel that you defined in the previous step to the receiver agreement.
  For more information, see: Defining Receiver Agreements
3. Activate the configuration objects.
  
  Note
  
  The procedure described assumes that you want to configure principal propagation for inbound and outbound channels of the Integration Server based on SAML. You can also configure a scenario in which principal propagation is based on SAML for the inbound channel of the Integration Server and on authentication assertion tickets for the outbound channel. In this case you must configure the outbound processing as described in Principal Propagation (Authentication Assertion Tickets) .
  
  End of the note.

Further information on configuring principal propagation in the Business Process Engine: Activating Principal Propagation in the BPE.