Identity Manager: TEWS Call Authorization with admin_id Impersonation and SiteMinder Basic Authentication

Products

• CA Identity Manager
• CA Identity Suite
• SITEMINDER

Issue/Introduction

This article explains the authorization logic for Identity Manager (IM) Task Execution Web Services (TEWS) when both "Enable admin_id (allow impersonation)" and "SiteMinder Basic Authentication" are active.

It addresses common scenarios where a user authenticates via SiteMinder but intends to run a task under a different security context using the admin_id parameter.

Environment

Identity Manager 14.x
SiteMinder 12.8

Cause

When "Enable admin_id (allow impersonation)" is selected, Identity Manager distinguishes between Authentication (handled by SiteMinder) and Authorization (handled by the admin_id context).

• SiteMinder: Validates the credentials provided in the SOAP Authorization header to allow the request through the gateway.
• Identity Manager: Uses the admin_id specified within the SOAP XML body to determine the security context and permissions for the specific task execution.

Resolution

The user context for task execution is determined by the admin_id provided in the SOAP XML, not the credentials used for SiteMinder authentication.

1. Authentication Phase:
   • Provide valid user credentials in the SOAP Authorization header. SiteMinder will verify these to permit the request.
2. Authorization Phase:
   • Specify the target execution user in the admin_id tag within the SOAP XML.
   • Example Scenario: If a user with low privileges authenticates via SiteMinder but specifies a superuser (e.g., imadmin) in the admin_id field, Identity Manager will execute the task with superuser privileges.
3. Configuration Verification:
   • Ensure "Enable Execution" and "Enable WSDL Generation" are checked in the IM Environment Web Services properties.
   • Verify "Enable admin_id (allow impersonation)" is active.
   • If "Admin password is required" is checked, the password for the admin_id must also be provided in the XML.

Additional Information

Siteminder - Impersonation