CA Identity Manager: Service Account Impersonation for TEWS SOAP API Calls

Products

• CA Identity Manager

Issue/Introduction

This article describes how to configure the Task Execution Web Service (TEWS) to allow a service account or regular user with limited permissions to impersonate the imadmin account. Customers may require this setup to avoid hardcoding primary administrator credentials in SOAP requests.

When this configuration is missing or incorrect, users may encounter symptoms such as:

• "Unknown processing error" in the SOAP response.
• "The operation could not be performed because this workitem has been reassigned to other users."

Environment

• 14.3, 14.4, 14.5
• Virtual Appliance (vApp) and Standalone

Cause

Use case required a use a regular account with more limited permissions instead of using Admin.

Resolution

Follow these steps to enable impersonation within the Management Console:

1. Access the IM Management Console (typically http://[hostname]:[port]/iam/immanage).
2. Navigate to Home > Environments > [Your Environment] (e.g., identityEnv).
3. Go to Advanced Settings > Web Services.
4. Select the check box for Enable Admin_ID (Allow impersonations).
5. Click Submit to save the changes.

 

Enable admin_id (allow impersonation)

Additional Information

• Impersonation Logic: When Enable admin_id (allow impersonation) is selected, TEWS uses the admin ID found in the SOAP message to authenticate the request. If this option is not selected, the ID of the user who generated the request is used for authentication.
• WSS Alternative: If your security requirements mandate moving credentials from the SOAP Body to the Header, utilize Web Services Security (WSS) instead. When WSS is active, the admin_id setting is ignored in favor of the wsse:Security header