We have implemented a custom AAA policy using XSLT to accept multiple authentications(WS-Security Header and Subject DN). After we implemented that change, DataPower is sending HTTP status code 400 when we use the decrypt-data function in XSLT instead of HTTP 200 for authentication and schema validation failures.

Below is what we implemented in AAA Policy Authentication.

1. Request comes with WS-Security username and password with AES-256 encryption.

2. DataPower decrypts the password.

3. Username and decrypted password will authenticated with LDAP(Active Directory)

4. If authentication failed, DataPower is sending HTTP status 400.

5. If authentication success, DataPower Validate the incoming SOAP request, If validation fails DataPower is sending HTTP status code 400.

6. This is happening only when we use decrypt function in XSLT otherwise if I use a plain text password, DataPower sends HTTP status code 200 OK for authentication failures and schema validation failures which is excepted.

I also tried Overriding the HTTP 400 with HTTP 200 with below code in error however its sending both HTTP status 400 and 200 as well.

<dp:remove-http-response-header name="'#status#'" />

<dp:set-http-response-header name="'#status1#'" value="'HTTP/1.1 200 OK'" />

When I try to print the decrypted password to log with <xsl :message> it's empty but LDAP authentication is a success.

Can any one please help me with this.

DataPower is providing the 400 after a decryption as part of a threat protection response. Please try to turn rewrite error messages off in the Padding Oracle Protection section in the XML Threat Protection tab in the MPGW. Please let us know if there is any change in the response after using decrypt.

--Charlie

Hi Charlie,

Thanks for your resposne.

After turning off rewrite error messages in the Padding Oracle Protection DataPower is sending the response http status code as expected.

--Gopi