IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Debugging AAC Policy

    Posted 02/15/21 03:06 PM
    Hi all:

    I already configured a AAC Policy, but I'm getting unexpected results.
    Which components in the Runtime Tracing should I set (to check the obligations, resources, policies evaluation, extracted values from the request to backend server that are used in Context-based Access or Risk-based Access?

    I already set com.ibm.sec.authz.*=ALL and I am not getting anything in the access_control/messages.log file.

    Thanks

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: Debugging AAC Policy

    Posted 02/15/21 03:11 PM

    Hi Joao,

    To see the messages turned on when you add tracing options, you need to look in the trace.log file rather than message.log. 


    As an additional trace, look for the one that has rtss in the name.

    Jon.  



    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Debugging AAC Policy

    Posted 02/15/21 03:58 PM
    Edited by Joao Goncalves 02/15/21 04:18 PM
    I just wanted the tracing specification I should use. Apparently com.ibm.sec.authz.* does not show anything.
    The trace.log does not show anything either. When debugging oidc I used the messages.log, and had everything I needed. Now that I am configuring AAC policies, I don't know where to look, and which parameters to set.

    The only rtss that I found is pdweb.rtss. I set this at level 9.

    I already found some information in the pdweb.rtss, I can see that the attribute I need to be retrieved from the junction, is being populated. It is stored in AZN_EAS_POP_LOCATION_ATTRIBUTE.
    Further down, I get an error, "Failed to find key [AZN_EAS_POP_ATTACHMENT_ATTRIBUTE]

    Where can I find information how to understand what is going on? What are these AZN_EAS_POP_xxxxxx?


    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: Debugging AAC Policy

    Posted 02/25/21 09:17 AM

    Hi Joao,

    Check the rba-pop and make sure it has the correct attribute and setting:

    pdadmin sec_master> pop list rba-pop attribute
    eas-trigger

    pdadmin sec_master> pop show rba-pop attribute eas-trigger
    eas-trigger
    trigger_rba_eas

    For tracing RP/AAC Policy Evaluation use pdweb.debug, pdweb.snoop, pdweb.wan.azn, pdweb.rtss for the RP.  With pdweb.wan.azn showing why the RP decided to do what it did and pdweb.rtss showing the XACML sent to AAC and the decision back.

    Use "com.ibm.sec.authz.*=ALL:com.ibm.tscc.rtss.*=ALL:com.tivoli.am.fim.*=ALL:
    com.tivoli.am.rba.*=ALL" for AAC.  With the rtss trace component showing the XACML evaluation and decision.



    ------------------------------
    Nick
    IBM Security Verify Customer Support
    ------------------------------

    Original Message


Related Content