IBM CWWIM1011E during PUMA lookup using SAML Trust Association Interceptor - United States SAML; SSO; TAI; PUMA; CWWIM1011E; InvalidUniqueNameException TECHNOTE (TROUBLESHOOTING)

PROBLEM
After configuring the Security Assertion Markup Language (SAML) SAML Trust Association Interceptor (TAI) in WebSphere Application Server, you attempt to access WebSphere Portal after authenticating to your Identity Provider (IdP), but you are unable to view the Portal page.

SYMPTOM
- Portal page is blank 

- SystemOut.log contains the following error at the time of the problem occurrence:

com.ibm.websphere.wim.exception.InvalidUniqueNameException: CWWIM1011E
The '<userId>' unique name is not valid.


CAUSE
SAML TAI parameter sso_<n>.sp.idMap = is configured to use "idAssertion" which results in the userid instead of the fully distinguished name of the user to be set in the JAAS subject. Portal then uses this value to query Virtual Member Manager (VMM) via findUserByIdentifier() and the failure occurs since the value is not formatted as a distinguished name.


DIAGNOSING THE PROBLEM
- Collect Portal Login troubleshooting data [http://www-01.ibm.com/support/docview.wss?uid=swg21592791] 

- Look for the following in security.xml:
<interceptors xmi:id="TAInterceptor_<identifier>" interceptorClassName="com.ibm.ws.security.web.saml.ACSTrustAssociationInterceptor">
...
<trustProperties xmi:id="Property_<identifier>" name="sso_1.sp.idMap" value="idAssertion"/> 

Note: There may be more than one sso_<n>.sp.idMap property (for example, sso_1.sp.idMap, sso_2.sp.idMap, etc). 


RESOLVING THE PROBLEM
 

Option #1: 

The idAssertion value means that no entry is necessary for the user in the user registry, which is not supported in WebSphere Portal by default. Update the sso_<n>.sp.idMap property via the Integrated Solutions Console to use the value "localRealm" instead of "idAssertion." 

The localRealm value ensures that WebSphere Application Server will complete the JAAS Subject with the full distinguished name for the user by querying the user registry and thus Portal will pass the correct format to VMM. 

Option #2: 

Transient user support [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/overview/new_cf08.dita?lang=en] has been introduced for SAML TAI [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/wcm/wcm_secure_int_tai_auth.dita?lang=en] starting with Cumulative Fix (CF) #8 for 8.5. Refer to the WebSphere Portal Security blog [https://www.ibm.com/developerworks/community/blogs/8f2bc166-3bdc-4a9d-bad4-3620dbb3e46c/entry/portal_transient_user_support_with_was_saml_tai_business_case_clarification?lang=en] for more details regarding the business case and implementation details. 

 

Note: WebSphere Portal also provides transient user support when configured with OpenId authentication [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/security/use_openid.dita?lang=en].

RELATED INFORMATION
 Understanding the SAML Trust Association Interceptor [http://www.ibm.com/developerworks/websphere/techjournal/1307_lansche/1307_lansche.html]
WebSphere Portal Support Statement [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/WebSphere_Portal_Support_Statement_wp8]

Question: Is transient user support available for SAML integration with WebSphere Portal 8.0? I am looking to leverage the SAML TAI provided by WebSphere Application Server for my WebSphere Portal 8.0 environment. Is transient user support available so that I do not have to maintain a local account in my Portal user registry for every external user which is verified and trusted by my identity provider? 

Answer: Transient user support [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/overview/new_cf08.dita?lang=en] has been introduced for SAML TAI [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/wcm/wcm_secure_int_tai_auth.dita?lang=en] starting with Cumulative Fix (CF) #8 for 8.5. Refer to the WebSphere Portal Security blog [https://www.ibm.com/developerworks/community/blogs/8f2bc166-3bdc-4a9d-bad4-3620dbb3e46c/entry/portal_transient_user_support_with_was_saml_tai_business_case_clarification?lang=en] for more details regarding the business case and implementation details.