Understanding WS-Security Processing using SAML Tokens

This section provides overviews of:

  • Inbound WS-Security processing using SAML tokens.

  • Outbound WS-Security processing using SAML tokens.

Inbound WS-Security Processing Using SAML Tokens

The inbound processing of service operations that are WS-Security-compliant using SAML tokens occurs on the integration gateway.

This diagram illustrates inbound WS-Security processing using SAML tokens when it is implemented. The diagram shows all possible security processing for an inbound integration to show where in the processing flow WS-Security processing occurs. WS-Security processing is highlighted in the foreground of the diagram. The diagram illustrates the steps of WS-Security processing using SAML tokens, including validating the existence of a WS-Security SOAP header and SAML token, the decryption of the SAML token if encrypted, and the validation of the passed in user ID.

Inbound WS-Security Processing using SAML Tokens

When any transaction arrives at the integration gateway, the PeopleSoft system checks for the existence of a WS-Security SOAP header. If it exists, the integration gateway decrypts the SAML token (if it has been encrypted) to restore the user ID information to clear text format.

The integration gateway then passes the user ID information to the application server, where additional security processing is performed.

Outbound WS-Security Processing Using SAML Tokens

This section discusses outbound WS-Security processing using SAML tokens.

WS-Security processing occurs on the integration gateway.

This diagram illustrates outbound WS-Security processing using SAML tokens. The diagram shows all possible security processing for an outbound integration to show where in the processing flow WS-Security processing occurs. WS-Security processing is highlighted in the foreground of the diagram. The diagram illustrates the steps of WS-Security processing using SAML tokens, including validating the logon user ID, the setting of the SAML token type, and finally the encryption of the token if encryption is specified.

Outbound WS-Security processing using SAML tokens.

When WS-Security is implemented for an outbound service operation, the integration gateway adds a WS-Security SOAP header to the service operation that contains SAML credentials defined in the node definition for the node. The SAML credentials can be comprised of any of the following from the node definition: Default User ID or PeopleSoft/Single Signon User ID. Additionally, you can choose to encrypt SAML credentials.

WARNING:

An any-to-local routing must be used on the sending system for outbound integrations using WS-Security processing and SAML tokens. Integrations will fail using any other routing type.