Enabling multi‑SAF for authorization

End-User Flow

Consider the following scenarios:

From the user’s perspective, the experience is simple and conversational. The user does not need to manage multiple credentials or understand backend complexities.

Behind the scenes, the system securely processes the request using the Token Exchange Service (TES), which plays a critical role in enabling controlled access to z/OS systems.

1. The user logs in to watsonx Orchestrate and navigates to the chat interface.
2. Agent receives the authenticated user context (email ID).
3. The token exchange service generates a one-time PassTicket for the user based on configured policy mappings.
4. Agent invokes the z/OS service using the PassTicket.
5. z/OS service validates the PassTicket and performs the operation.

TES architecture and deployment models

The following diagram illustrates the TES architecture:

The architecture connects a watsonx Orchestrate service instance (tenant) to multiple z/OS systems using context-based connections defined by user-provided keys (such as SYS_A and SYS_B). Each connection routes requests to a dedicated Token Exchange Service (TES) instance deployed in a specific environment.

Each TES instance runs as a Liberty application and generates PassTickets locally using SAF, ensuring system-level isolation and compliance with enterprise security policies.

TES is deployed independently in each monoplex or sysplex environment. Each deployment is self-contained and operates without dependencies on other systems. Each system (sysplex or monoplex) hosts its own TES instance. This ensures local availability, isolates failures, and eliminates cross-system dependencies.

Setting up the configuration for agents to support multi-SAF

As a system administrator, you can configure multi-SAF support for an agent by creating an agent-specific configuration in the Authorization Service. Provide the agent ID, context key, and configuration settings in JSON format, as shown in the following example.

{
  "agent_id": "agent_id",
  "context": "unique-key",
  "config": {
    "key": "value",
    "key2": "value2"
  }
}

Setting up the connection for agents to support multi-SAF

To optimize LPAR selection by an agent, focus on context. By implementing a context-driven or tag-driven selection process, agents can dynamically access multiple LPARs based on specific criteria that align with their intended use or operational requirements.

When handling agent subscriptions and ensuring secure interactions with multiple LPARs (Logical Partitions), collect and use relevant context information.

{
    "tenant_id": "string //Unique identifier for the tenant requesting the agent",
    "agent_id": "string Unique identifier for the agent",
    "authz": [
        {
          "zos_url": "string //URL of the z/OS system where passticket service is running",
          "port": "string //Port number for the z/OS system",
          "context": "unique-key",
          "client_cert": "string //Client certificate for the passticket   service",
          "client_key": "string //Client key for the passticket service"               
        }
    ]
}