IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  AccessPolicy

    Posted 11/14/22 04:54 AM
    Hi,

    I did something for 5 years ago and trying to implement it in docker containers but i can't get it to work.

    I have implemented what's described in these two articles with some own customizing's.

    * https://philipnye.com/2015/02/23/isam-for-mobile-ropc-oauth-username-and-password-validation/
    * https://community.ibm.com/community/user/security/blogs/shane-weeden1/2016/11/29/an-introduction-to-the-infomap-authentication-mech

    What i want to achieve is the bellow.

    https://hostname/mga/sps/oauth/oauth20/authorize?client_id=1234567890&scope=my_scope&response_type=code&PolicyId=urn:ibm:security:authentication:asf:username_login&redirect_uri=http://localhost
    redirect -> 

    https://hostname/mga/sps/auth (it stops here now in the new environment, but in the old solution i have got it to redirect to the next step below which also shows
    the branded page.
    redirect ->

    https://hostname/mga/sps/authsvc?client_id=1234567890&scope=my_scope&response_type=code&PolicyId=urn:ibm:security:authentication:asf:username_login&redirect_uri=http://localhost

    I probably have missed some configuration but I'm unable to remember how i solved it.

    Trace log from the working one and here you see that it uses the RedirectPolicy correctly, but it's not getting called in the new setup.

    2061 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.authservice.GenericPocSignIn > authenticate(FederationManagerContext, MultiPhaseAuthenticationEventCallback, AccessPolicyContext) ENTRY

    2062 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.authservice.GenericPocSignIn > callTheAuthenticateCallbacks(FederationManagerContext) ENTRY

    2063 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 ivoli.am.fim.fedmgr2.callback.webseal.WebSealPocCallbackBase > canProcess(FederationManagerContext) ENTRY

    2064 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 ivoli.am.fim.fedmgr2.callback.webseal.WebSealPocCallbackBase > getUserId(Request) ENTRY

    2065 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 ivoli.am.fim.fedmgr2.callback.webseal.WebSealPocCallbackBase 3 getUserId(Request) user id header: Unauthenticated user id header name: iv-user

    2066 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 ivoli.am.fim.fedmgr2.callback.webseal.WebSealPocCallbackBase < getUserId(Request) RETURN Unauthenticated

    2067 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 ivoli.am.fim.fedmgr2.callback.webseal.WebSealPocCallbackBase 3 canProcess(FederationManagerContext) Callback can process the current request = true

    2068 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 ivoli.am.fim.fedmgr2.callback.webseal.WebSealPocCallbackBase < canProcess(FederationManagerContext) RETURN

    2069 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 .fim.fedmgr2.callback.webseal.WebSealPocAuthenticateCallback > authenticate(FederationManagerContext) ENTRY

    2070 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 .fim.fedmgr2.callback.webseal.WebSealPocAuthenticateCallback 3 authenticate(FederationManagerContext) Request is made via /sps/auth.

    2071 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 .fim.fedmgr2.callback.webseal.WebSealPocAuthenticateCallback < authenticate(FederationManagerContext) RETURN

    2072 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.authservice.GenericPocSignIn < callTheAuthenticateCallbacks(FederationManagerContext) RETURN

    2073 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.AccessPolicyExecutor > execute(AccessPolicyContext, boolean) ENTRY

    2074 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.om.ObjectManager > get(Class<C>) ENTRY

    2075 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.om.ObjectManager$Configuration > getObject(Class<C>) ENTRY

    2076 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.om.ObjectManager$Configuration 3 getObject(Class<C>) Class com.tivoli.am.fim.fedmgr2.policy.AccessPolicyFactory from version 1668298053569.

    2077 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.om.ObjectManager$Configuration < getObject(Class<C>) RETURN

    2078 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.om.ObjectManager < get(Class<C>) RETURN

    2079 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.AccessPolicyFactory > getAccessPolicy(Long) ENTRY 1

    2080 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.AccessPolicyFactory 3 getAccessPolicy(Long) Returning access policy from cache.

    2081 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.AccessPolicyFactory 3 getAccessPolicy(Long) Access policy [com.tivoli.am.fim.fedmgr2.policy.js.JSAccessPolicy@90709290].

    2082 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.AccessPolicyFactory < getAccessPolicy(Long) RETURN

    2083 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.AccessPolicyExecutor 2 execute(AccessPolicyContext, boolean) Executing access policy [RedirectPolicy].

    2084 [11/14/22, 7:36:03:527 CET] 00001172 id=00000000 com.tivoli.am.fim.fedmgr2.policy.js.JSAccessPolicy > execute(JSAccessPolicyContext) ENTRY



    ------------------------------
    Regards Mikael
    ------------------------------


  • 2.  RE: AccessPolicy

    Posted 11/16/22 08:29 AM

    Hi,

    I remembered the solution i had to fix the acl so now it works.

    ------------------------------
    Regards Mikael
    ------------------------------



Related Content