Content Navigator Security Access Manager WebSphere187 Comments on IBM Content Navigator – Using SAML as single sign on method
IBM Content Navigator – Using SAML as single sign on method

In this article I want to guide you how to setup WebSphere Application Server to use SAML as authentication provider for Content Navigator.

A first I need to adress that there are two ways of SAML authentication. The first is the so called IdP initiated SAML where the identity provider initiates the SAML request. And the second one is the SP initiated SAML request, where the service provider (in our case WebSphere/Content Navigator) initiates the request.

We will cover both scenarios with a step-by-step guide. In this guide we have the following system setup.

  • IBM Content Navigator 3.0.8
  • WebSphere Application Server V9.0 FP11 as SP
  • IBM DB2 11.5 FP4
  • IBM Security Access Manager / IBM Cloud Identity as IdP

For more information about WebSphere Application Server SAML configuration please refer tho the following IBM Infocenter article.

https://www.ibm.com/support/knowledgecenter/en/SSAW57_9.0.5/com.ibm.websphere.nd.multiplatform.doc/ae/cwbs_samlssosummary.html

  1. Prepare Content Navigator for SAML

At first you need to deploy Content Navigator with “application server authentication” so use SSO in generell independently of you prefered SSO method.

Open the Content Navigator Configuration and Deployment Tool and create a new profile or reuse a existing one. Complete all for you repository type necessary steps.

In the “Configure the IBM Content Navigator Web Application” task select the application server authentication as you Content Navigator authentication method.

Finish your deployment and restart WebSphere Application Server.

2. Prepare WebSphere Application Server for SAML

At first you need to install the WebSphere SAMLSP.ear to you application server with the following wsadmin command.

wsadmin.sh/bat -f installSamlACS.py install <NodeName> <ServerName>

If you have a HTTP Server in front of your WebSphere AS map the application also to the HTTP Server.

Import the IdP SSL certificate on your SSL truststore.

This image has an empty alt attribute; its file name is image-10.png

A easy way to do this is just to retrieve it from the SSL port of the IdP.

This image has an empty alt attribute; its file name is image-11.png

The next step is to create a new TAI interceptor in the global security. Logon to the WebSphere ISC and create the new interceptor.

Add the following custom properties. Here it depends also a little bit on your IdP which parameters a required and which are optional. In my case these are the settings for ISAM.

After adding the required properties activate the trust association.

Add the following custom properties to the global security.

com.ibm.websphere.security.DeferTAItoSSOcom.ibm.ws.security.web.saml.ACSTrustAssociationInterceptor
com.ibm.websphere.security.InvokeTAIbeforeSSOcom.ibm.ws.security.web.saml.ACSTrustAssociationInterceptor

Now we need to import the IdP metadata into our TAI configuration with the wsadmin command.

wsadmin.sh/bat -lang jython

AdminTask.importSAMLIdpMetadata(‘-idpMetadataFileName C:\IBM\SAML\idp_meta.xml signingCertAlias idm.timetodemo.com’)

AdminConfig.save()

Now we need to export the SP metadata that needs to be imported by the IdP. You can do this again with the wsadmin command.

AdminTask.exportSAMLSpMetadata(‘-spMetadataFileName C:\IBM\SAML\sp_meta.xml -ssoId 1’)

To verify your IdP configuration you can show the SAML config.

AdminTask.showSAMLIdpPartner(‘-ssoId 1’)

Now you have finished the basic SAML configuration in your WebSphere Application Server that is identical for IdP and SP initiated SAML.

3. Custom configuration for IdP initiated SAML

In this chapter I will guide you how to setup the IdP initiated SAML. There are some properties in the TAI interceptor where you can control the behavior of SAML.

To enable the IdP initiated Request you need to change the sso_1.sp.login.error.page parameter to the URL that calls the IdP and the relay adress of your WAS ACS and Content Navigator.

e.g.:

https://idm.timetodemo.com/isam/sps/idpisam/saml20/logininitial?PartnerSpid=https://p8icn.timetodemo.com:9443/samlsps/acs&RelayState=https://p8icn.timetodemo.com:9443/navigator

Please keep in mind that the URL above is a example for ISAM and IBM Cloud Identity. Your IdP may require some changes in the URL properties. You should consult your IdP administrator before set this property.

The second parameter you should set to false is the “useRelayStateForTarget”. This controls whether you want to use the value of RelayState in the client request as the URL of the target application. If you set this to true (default) the IdP will relay you to the “acsURL” adress. But in our case we want to be reroutet to the “targetURL” parameter. So useRelayStateForTarget = false is the correct setting for us here.

If you need some more information about the properties you can define, please refer to the following IBM infocenter artiicle:

https://www.ibm.com/support/knowledgecenter/SSEQTP_9.0.5/com.ibm.websphere.base.doc/ae/rwbs_samltaiproperties.html

Now you have finished all required configuration steps to use IdP initiated SAML for IBM Content Navigator.

4. Custom configuration for SP initiated SAML

The next chapter will describe how to configure the TAI interceptor to use SP initiated SAML. For SP initiated SAML you need to modify the sso_1.sp.login.error.page property to use your custom JAVA class, where you create the SAML request.

In my case I wrote a class called “de.tta.was.saml.SPInitiated”. You need to place the JAR file in your WebSphere Application Server external library path. E.g: C:\IBM\WebSphere\AppServer\lib\ext.

I used the following code snipped as base for developing the java class, that is provided in this IBM infocenter article:

https://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.base.iseries.doc/ae/tsec_enable_saml_sp_sso.html

import java.util.ArrayList;
                import java.util.HashMap;
                import javax.servlet.http.HttpServletRequest;
                import com.ibm.websphere.security.NotImplementedException;
                import com.ibm.ws.wssecurity.saml.common.util.UTC;
                import com.ibm.wsspi.security.web.saml.AuthnRequestProvider;
                .........

                public HashMap <String, String> getAuthnRequest(HttpServletRequest req, String errorMsg, 
			   String acsUrl, ArrayList<String> ssoUrls)
	        throws NotImplementedException {
	   
	        //create map with following keys
	        HashMap <String, String> map = new HashMap <String, String>();
	       
	        String ssoUrl = "https://example.com/saml20/Login";
	        map.put(AuthnRequestProvider.SSO_URL, ssoUrl);

	        String relayState = generateRandom();
	        map.put(AuthnRequestProvider.RELAY_STATE, relayState);

	        String requestId = generateRandom();
	        map.put(AuthnRequestProvider.REQUEST_ID, requestId);
	        
	        //create AuthnRequest	        	        
	        String authnMessage = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
				   +"<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" "
				   +"ID=\""+requestID+"\" Version=\"2.0\" "
				   + "IssueInstant=\"" +UTC.format(new java.util.Date())+ "\" ForceAuthn=\"false\" IsPassive=\"false\""
				   + "ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" "
				   + "AssertionConsumerServiceURL=\"" +acs+"\" "
				   + "Destination=\"" +destination +"\"> "
				   + "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">"
				   + issuer
				   +"</saml:Issuer> <samlp:NameIDPolicy"
				   +"Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\""
				   +"SPNameQualifier=\"mysp\""
				   +"AllowCreate=\"true\" /> <samlp:RequestedAuthnContext Comparison=\"exact\"> "
				   +"<saml:AuthnContextClassRef xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">"
			         +"urn:oasis:names:tc:SAML:2.0:ac:classes:</samlp:RequestedAuthnContext> </samlp:AuthnRequest>";

	        map.put(AuthnRequestProvider.AUTHN_REQUEST, authnMessage);
                return map;
	        }
             private String generateRandom() {
             //implement code that generates a random alpha numeric String that is unique
             //each time it is invoked and cannot be easily predicted (like a counter)
             }

5. Troubleshooting

Specially when you use SP initiated SAML you may experience some issue with the created SAML request. A good way for debugging is the use of the browser addon “SAML-tracer”. You can check the request generated by your java class and also see why the IdP may reject it.

If you have question regarding this article feel free to contact me.

Over and out :-).

187 thoughts on “IBM Content Navigator – Using SAML as single sign on method”

  6. I will immediately clutch your rss feed as I can’t in finding your e-mail subscription hyperlink or newsletter service. Do you’ve any? Please let me recognise so that I may subscribe. Thanks.

  9. Discover CowSwap, the trusted decentralized exchange platform for seamless crypto trades in 2025. With low fees, high security, and fast transactions, CowSwap is a go-to solution for DeFi users worldwide

  10. Discover the future of decentralized finance with Woofi Finance, a cutting-edge platform for seamless crypto staking and yield farming. Maximize your returns with low fees and high rewards. Join the revolution in DeFi today!

  11. Discover CowSwap, the trusted decentralized exchange platform for seamless crypto trades in 2025. With low fees, high security, and fast transactions, CowSwap is a go-to solution for DeFi users worldwide

  12. Howdy! This post couldn’t be written any better! Looking through this post reminds me of my previous roommate! He always kept talking about this. I am going to forward this post to him. Fairly certain he will have a good read. Thank you for sharing!

  13. Wonderful paintings! That is the kind of information that are supposed to be shared across the internet. Disgrace on the seek engines for no longer positioning this submit higher! Come on over and seek advice from my site . Thanks =)

  33. Excellent read, I just passed this onto a colleague who was doing some research on that. And he actually bought me lunch since I found it for him smile So let me rephrase that: Thank you for lunch!

  35. Great post. I was checking continuously this blog and I am impressed! Very useful info specifically the last part 🙂 I care for such information much. I was looking for this certain information for a long time. Thank you and best of luck.

  38. The core of your writing while appearing reasonable initially, did not really sit very well with me personally after some time. Someplace within the sentences you managed to make me a believer but only for a short while. I still have got a problem with your leaps in logic and you might do well to fill in all those breaks. In the event that you can accomplish that, I could undoubtedly end up being amazed.

  44. obviously like your web-site but you have to check the spelling on quite a few of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth nevertheless I’ll surely come back again.

  46. hi!,I really like your writing so so much! percentage we communicate extra approximately your article on AOL? I require an expert on this space to unravel my problem. May be that is you! Taking a look ahead to peer you.

  61. Wow! This could be one particular of the most beneficial blogs We have ever arrive across on this subject. Basically Wonderful. I’m also an expert in this topic therefore I can understand your hard work.

  71. Have you ever considered creating an ebook or guest authoring on other websites? I have a blog based upon on the same topics you discuss and would really like to have you share some stories/information. I know my readers would enjoy your work. If you’re even remotely interested, feel free to send me an e mail.

  72. What’s Taking place i’m new to this, I stumbled upon this I have discovered It positively helpful and it has aided me out loads. I’m hoping to give a contribution & assist different users like its aided me. Good job.

  73. I think this is among the most important info for me. And i’m glad reading your article. But want to remark on some general things, The website style is perfect, the articles is really great : D. Good job, cheers

  84. Very nice post. I just stumbled upon your blog and wanted to say that I ave really enjoyed browsing your blog posts. In any case I all be subscribing to your rss feed and I hope you write again soon!

  92. I cling on to listening to the news bulletin talk about getting free online grant applications so I have been looking around for the best site to get one. Could you tell me please, where could i get some?

  97. Hello my family member! I want to say that this post is amazing, nice written and include approximately all significant infos. I’d like to see extra posts like this.

  108. hello!,I really like your writing so a lot! share we keep in touch extra approximately your article on AOL? I require an expert on this house to solve my problem. Maybe that’s you! Having a look forward to look you.

  111. I am no longer sure the place you’re getting your info, butgreat topic. I must spend some time studying much more or figuring out more.Thanks for magnificent info I was in search of thisinformation for my mission.

  120. When someone writes an piece of writing he/she maintainsthe idea of a user in his/her mind that how a user can be aware of it.Thus that’s why this piece of writing is great. Thanks!

  122. Hi my family member! I wish to say that this article is awesome, great written and include approximately all significant infos. I would like to see extra posts like this.

  124. Das NetBet Online Casino ist der beste Ort, um zu spielen, Boni zu verdienen und neue Möglichkeiten für ein nahtloses Spielerlebnis auf der Website oder in der App zu entdecken.

  131. What’s Taking place i am new to this, I stumbled upon this I’ve found It positively helpful and it has aided me outloads. I am hoping to give a contribution & assist other customers like its helped me.Great job.

  148. Thanks for any other fantastic post. Where else may anyone get that type of info in such a perfect methodof writing? I’ve a presentation next week, and I’m on the search for such info.

  151. Superb post however , I was wanting to know if you could write a litte more on this topic? I’d be very grateful if you could elaborate a little bit more. Thanks!

  162. “Great read! You’ve officially made my brain work harder than my morning coffee. Can’t wait to see what’s next!”

    SG8 Sg8 offers the biggest cashback in the Philippines! Play your favorite games and get more rewards – it’s the best deal around! Don’t miss out!”

  167. We are looking for experienced people that might be interested in from working their home on a part-time basis. If you want to earn $500 a day, and you don’t mind creating some short opinions up, this might be perfect opportunity for you!

  168. We are searching for some people that might be interested in from working their home on a part-time basis. If you want to earn $100 a day, and you don’t mind writing some short opinions up, this is the perfect opportunity for you!

  170. THE88THAI คือแหล่งรวมเกมสล็อตออนไลน์ที่คุณสามารถเล่นได้ทุกที่ทุกเวลา https://the88me.net/ เว็บไซต์ของเรารองรับการเล่นบนมือถือและคอมพิวเตอร์ ทำให้คุณสามารถเพลิดเพลินกับเกมสล็อตได้อย่างสะดวกสบาย นอกจากนี้ยังมีเกมสล็อตที่มาจากค่ายดังที่มีชื่อเสียง ไม่ว่าจะเป็นเกมที่มีธีมผจญภัย หรือเกมที่มีฟีเจอร์โบนัสที่สามารถเพิ่มโอกาสในการชนะรางวัลได้ง่ายขึ้น ด้วยระบบการฝาก-ถอนที่เร็วและปลอดภัย คุณสามารถทำธุรกรรมได้อย่างรวดเร็วและปลอดภัย พร้อมทั้งรับประสบการณ์การเล่นสล็อตที่ดีที่สุด

Leave a Reply

Your email address will not be published. Required fields are marked *