Sort summary:
This enhancement request applies specifically to Integration Server Administrator (WmAdmin) and its SAML SSO implementation.
The goal is to allow users with read-only administrative access to use SAML SSO in the same way they can currently use LDAP username/password authentication.
Product:
IBM webMethods Integration Server 11.1 (WmAdmin)
Business Need:
Many organizations implement read-only administrative access to Integration Server for operational support teams, monitoring teams, middleware support teams, and auditors.
These users require browser-based access to WmAdmin to review runtime and configuration information but should not have permissions to perform administrative changes.
In our environment, read-only access has been successfully implemented for many years.
The read-only users are currently able to access WmAdmin and WmRoot in read-only mode using standard LDAP authentication.
Problem:
Currently, when SAML SSO is enabled for WmAdmin, browser-based access is only transferred successfully for users who are members of the built-in Administrators ACL.
Users who:
- Belong to ReadOnlyAdministrators
- Belong to custom read-only ACLs
- Can successfully access WmAdmin using LDAP username/password authentication
cannot access WmAdmin through SAML SSO.
The SAML authentication itself succeeds and the user is correctly identified. However, the SSO handover to WmAdmin does not occur unless the user is a member of the Administrators ACL.
As a result:
- LDAP authentication supports read-only browser access.
- SAML authentication does not support the same access model.
This creates inconsistent behavior depending on the authentication mechanism used.
Current Impact
Organizations adopting enterprise SSO standards cannot provide the same read-only browser access experience that already exists for LDAP-authenticated users.
To enable SAML SSO access today, customers must either:
- Continue using username/password authentication for read-only users.
- Grant membership in the Administrators ACL, which violates the principle of least privilege.
Neither option is desirable.
Requested Enhancement
Allow WmAdmin SAML SSO login for users who successfully authenticate and who have one of the following:
- Membership in ReadOnlyAdministrators
- Membership in a supported read-only administrative role
- Membership in custom ACLs that provide equivalent read-only administrative access
The authorization behavior after SAML authentication should be aligned with the existing username/password login behavior.
Expected Result
If a user can successfully access WmAdmin using LDAP authentication in read-only mode, the same user should be able to access WmAdmin through SAML SSO without requiring membership in the Administrators ACL.
Benefits
- Consistent behavior across authentication methods.
- Easier adoption of corporate SSO standards.
- Improved security by avoiding unnecessary assignment of administrator privileges.
- Better support for operations, monitoring, support, and audit teams.
- Reduced need for custom workarounds or unsupported modifications.
Additional Notes
IBM Support reviewed our implementation under ticket: TS023344334 and confirmed that:
- SAML authentication succeeds.
- User resolution succeeds.
- WmAdmin identifies the user correctly as a read-only administrator.
- The limitation is related to the current WmAdmin SSO authorization design rather than authentication.
Therefore, this request is submitted as a product enhancement rather than a defect report.
