Dears,

Testing an AAA Client IP Auth rule with a no-valid client IP I get a status code of 500 Internal Error, instead of a 401 Unauthorized. Cheking the debug logs everything appears normal, the XML file DP validates against has rules for valid IPs and no valid ones, granting access to those that are allowed and denying the rest with the wildcard .*

It is important to display to the client the correct status code, in this case the 401.

¿any idea?

Regards,

SebasQuiroga

Hi,

status code 500 is DataPower default behavior in case of an error. A security measure so that it is not giving too much information to a possible attacker. If you want to return something else than error 500, create an error rule that catches the error and set error-protocol-response and error-protocol-reason-phrase variables. And remember to disable "Rewrite Error Messages" under Oracle padding attack in XML threat protection settings. An example of setting the variables in XSLT:

<dp:set-variable name="'var://service/error-protocol-response'" value="'401'" />

<dp:set-variable name="'var://service/error-protocol-reason-phrase'" value="'Unauthorized'" />

--HP

Thank you!