Using the STS Get SAML 2.0 Token activity

The Get SAML 2.0 Token activity is used to send a request that conforms to WS-Trust standard specification, to the Secure Token Service (STS) Provider. The request message is called the Request Security Token (RST). On receiving the request, the STS generates the requested token and sends it as part of the response, called the Request Security Token Response (RSTR). For this activity, the only token that is requested is SAML 2.0 token/assertion.

Configuring the Get SAML 2.0 Token activity in the orchestration

  1. Create or open an orchestration. A graphical representation of the orchestration is displayed.
  2. Select the Activities tab and expand the STS folder.
  3. Drag the Get SAML 2.0 Token activity onto the orchestration.
  4. Select the activity. The Checklist is displayed.

The Get SAML 2.0 Token activity requires an endpoint to be configured, to send the request for a security token to the external STS (Secure Token Service). The endpoint that is used in this activity is called the STS endpoint. The configuration parameters and functions of this endpoint are similar to the HTTP endpoint. However, this endpoint has properties that are specific to the Get SAML 2.0 activity.

Creating, selecting, or editing an STS endpoint

  1. Click Pick Endpoint task from the Checklist and choose from one of the following actions:
    • Select an existing endpoint:
      1. Select Browse. The Project Explorer is displayed.
      2. Select an existing endpoint and click OK. Skip to the "Configure the activity" procedure.
    • Select an existing endpoint and edit the endpoint:
      1. Select Browse. The Project Explorer is displayed.
      2. Select an existing endpoint and click OK.
      3. Click Edit. The Edit Endpoint pane is displayed.
    • Create a new endpoint: Select New. The Create Endpoint pane is displayed.
  2. Create or edit an STS endpoint. See Creating or editing an STS endpoint.

Configuring the activity

  1. Select the Configure task from the Checklist. The Configure pane is displayed.
  2. Configure all the fields and check boxes in this pane as described in the following table:
    Table 1.
    Field or Check Box Description
    Request
    URL (Path after Hostname) Specifies the URI path that the Get SAML 2.0 Token activity sends the request to, for example: TrustServerWST13/services/RequestSecurityToken. The string that you specify in this field must exclude the protocol, for example: http://, the host name, and the port number of the Integration Appliance. The full URL is automatically constructed from the host name of the Integration Appliance, the port number that is specified in the STS endpoint, and the URI path that is specified in this field. For example, if the complete URL that the Get SAML 2.0 Token activity sends the request to, is http://<applianceHost>:<appliancePort>/<URI>, in this field, you must only specify the URI.
    SAML Security Token Service Properties
    Request Type This activity supports only issuing of SAML 2.0 token/assertion. The default value is http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue.
    Applies To The recipient endpoint reference/entity of SAML 2.0 token/assertion.
    Issuer The authority responsible for issuing SAML 2.0 token/assertion.
    Token Type This activity issues SAML 2.0 token/assertion. The default value is SAML v2.0. If you select None as the Token Type, then, no token type is sent as a part of the request.
    Note: Some STS services do not require a token type, but issues tokens that are based on the configurations in STS.

Mapping the input into the activity

  1. Select the Map Inputs task in the Checklist. The header input parameter is displayed in the To Activity pane of the Map Inputs task. The header input parameter is mandatory. The header input parameter contains the WSSE standard Username Token.
  2. To view the optional input parameter in the To Activity pane of the Map Inputs pane, select Map > Show Optional Parameters from the toolbar menu or right-click in the To Activity pane and select the Show Optional Parameters option. If the Map > Show Optional Parameters option is not selectable in the toolbar menu, click a node in the Map Inputs pane to make this option active. The requestSecurityToken, location, httpheaders, and proxyConnection input parameters are displayed.
    The following table defines the nodes of the optional httpheaders input parameter:
    Table 2.
    Input parameter Description
    requestSecurityToken requestSecurityToken is sent as a SOAP body, which is interpreted by STS. Based on the input, STS issues the SAML 2.0 token/assertion.
    Note: If the values are populated in requestSecurityToken, the values that are provided in the Configure panel will not be considered.
  3. Create a map between the orchestration variable or variables and the input parameter or parameters. See Creating a map for general instructions on mapping

Mapping the output of the activity

  1. Select the Map Outputs task in the Checklist. The output parameters of the activity are displayed in the From Activity pane of the Map Outputs task as described in the following table:
    Table 3.
    Output Parameter Description
    httpheaders Specifies the HTTP header of the response.
    assertion Contains the SAML 2.0 token/assertion.
  2. Create a map between the output parameter or parameters of the activity and orchestration variable or variables. See Creating a map for general instructions on mapping.



Feedback | Notices


Timestamp icon Last updated: Wednesday, 15 June 2016


http://pic.dhe.ibm.com/infocenter/wci/v7r0m0/topic/com.ibm.wci.doc/sts_get_saml_20_token.html