Provide a supported, conflict-free SAML/OIDC SSO integration for IBM Business Automation Workflow (BAW) with PingFederate

Product / Component: IBM Business Automation Workflow (BAW) — Security / Single Sign-On Affected version(s): v24.0.1 on WebSphere Application Server 8.5.5.31 Environment: [Traditional WAS ND cell / on-prem Linux — "8.10 (Ootpa)"] Identity Provider: PingFederate 13.0.2

Summary of the idea

We request a documented, supported, and library-conflict-free method to integrate IBM BAW with PingFederate for browser-based Single Sign-On (SAML 2.0 Web SSO and/or OpenID Connect), validated end-to-end against the full BAW application stack (Process Portal, Process Admin Console, Case/Workflow web applications, and REST APIs). Current guidance does not work cleanly on BAW due to conflicting JAR dependencies.

Problem / Pain point

IBM and Ping both document SSO integration for WebSphere Application Server using the SAML Web SSO Trust Association Interceptor (TAI) and wsadmin metadata import. However, when we apply this guidance to BAW (which layers Process Portal, workflow runtime, and additional applications on top of WAS), we encounter conflicting/duplicate JAR issues that prevent the SSO integration from functioning.

Specifically:

• We've an issue while we edit any BPM artifact , save it and reopen again the changes won't be reflected and we're encountered with the pop-up saying "A problem was found with the most recent version so the last valid version of the artifact will be opened."
• [Name the conflicting JARs, e.g.: "BAW ships [jar-A vX] while the SSO/TAI path requires [jaxb-api-2.3.1.jar and jaxb-runtime-2.3.1.jar], causing a classloader conflict."]
• The WAS-level documentation does not account for BAW's bundled libraries and classloader configuration, so steps that succeed on plain WAS fail on BAW.

Business impact

• We cannot enforce enterprise-standard SSO (PingFederate) for BAW users, creating an authentication inconsistency across our application portfolio.
• [Security/compliance impact, e.g.: "This blocks our enterprise mandate to centralize authentication and MFA through Ping, leaving BAW on a separate login path."]
• Significant engineering time has been spent working around undocumented JAR conflicts with no supported resolution.
• [Scale, e.g.: "Affects  BAW RISK cells / Mutiple users across QA and Production."]

Root cause (as we understand it)

The published WAS SSO/TAI integration steps are not validated against BAW's packaged runtime. BAW bundles its own versions of common libraries ([list, e.g., OpenSAML/xmlsec/Bouncy Castle/Apache Santuario/etc.]) that conflict with the versions required by the SAML TAI / Ping integration, and there is no documented isolated-classloader or shared-library configuration to resolve this on BAW.

Requested enhancement (the ask)

We ask IBM to provide one or more of the following:

1. BAW-specific, supported SSO integration documentation for PingFederate (SAML 2.0 and OIDC), explicitly accounting for BAW's bundled libraries and classloader model — including any required isolated/shared-library configuration to avoid JAR conflicts.
2. A tested reference configuration (versions, classloader policy, TAI setup, wsadmin steps) confirmed to work across the full BAW stack: Process Portal, Process Admin Console, workflow/case web apps, and REST APIs.
3. If a library conflict exists in the shipped product, a product fix or guidance to align/isolate the conflicting JARs so standards-based SSO works out of the box.
4. Explicit statement of REST/API SSO handling (non-browser clients) alongside the browser SAML/OIDC flow.

Acceptance criteria / definition of done

• A customer following the documentation can enable PingFederate SSO on a standard BAW install without manual JAR surgery and without unsupported modifications.
• SSO works for Process Portal, Process Admin Console, and workflow/case applications.
• The solution is supported by IBM (not a community workaround) and version-matrixed to current BAW/WAS fix packs.

Workarounds attempted (and why they're insufficient)

• Please see TS022879203

Supporting references

• Ping Identity — Configuring SSO in WebSphere: https://docs.pingidentity.com/integrations/websphere/setup/pf_websphere_integration_configuring_single_sign_on_in_websphere.html
• Ping Identity — SP-initiated SSO: https://docs.pingidentity.com/integrations/websphere/setup/pf_websphere_integration_configuring_service_provider_initiated_sso.html
• IBM WAS — Enabling SAML SP-initiated Web SSO (SAML TAI): https://www.ibm.com/docs/ (SAML TAI topic for your WAS version)