DataPower

DataPower

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Decryption operation step returning more than just the decrypted value (adds headers + response code)

    Posted 12/02/20 08:54 PM

    I have an XML Firewall in which I am sending an encrypted XML document inside of a soap body, like so:

    <?xml version="1.0" encoding="UTF-8"> <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <env:Body> <xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/> <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedKey Recipient="name:Cert"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <dsig:KeyInfo> <dsig:KeyName>cert</dsig:KeyName> </dsig:KeyInfo> <xenc:CipherData> <xenc:CipherValue>STUFF</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> </dsig:KeyInfo> <xenc:CipherData> <xenc:CipherValue>etc etc etc </env:Body> </env:Envelope>

    From there, I'm extracting it and decrypting it, and I name the Output variable as "decryptedBKP"

    So then I get this value with an XSL sheet like so:

    <xsl:variable name="decryptedBackupBase64" select="dp:variable('var://context/decryptedBKP')"/>

    After that, I put it into a dp:url-open call to do a soma restore request. Normally, in the past, it is the just the decrypted string and that's all. But when I probe the request body lately, the output include a bunch of headers and a response code.

    I actually have this same exactly XMLFW with identical configs running on 2 appliances right now. One of them works like it always did, and one has the extra headers and such.

    This appliance outputs the decrypted string from that XSL vairable (above) like normal:

    Firmware:IDG.2018.4.1.0

    Build:304317

    UEsDBAoAAAAAAENrgVEAAAAAAAAAAAAAAAAHABwAZHAtYXV4L1VUCQADzZjGX86Yxl91eAsAAQQAAAAABAAAAABQSwM.............

    And this appliance outputs the same string but with the extra info added:

    Firmware:IDG.2018.4.1.10kw2

    Build:321857kw2

    200text/xmlb0d4b4f15fc68eaf01fd5e1f1.1 xml-mgmt10.158.22.54text/xmlmax-age=31536000; includeSubDomainssameorigin1; mode=blocknosniffdefault-src 'self'Tue, 01 Dec 2020 18:44:50 GMT2020-12-01T12:42:55-06:00UEsDBAoAAAAAAJhlgVEAAAAAAAAAAAAAAAAHABwAZHAtYXV4L1VUCQADH4.............

    #DataPower
    #Support
    #SupportMigration


  • 2.  RE: Decryption operation step returning more than just the decrypted value (adds headers + response code)

    Posted 12/04/20 08:31 AM

    Hi,

    How do you set the value of the context variable? Looks like you have a full text content of url-open response inside the variable...

    --HP



    #DataPower
    #Support
    #SupportMigration


  • 3.  RE: Decryption operation step returning more than just the decrypted value (adds headers + response code)

    Posted 12/04/20 03:30 PM

    The Context variable "decryptedBKP" comes from the Output of the Decrypt style policy step



    #DataPower
    #Support
    #SupportMigration


  • 4.  RE: Decryption operation step returning more than just the decrypted value (adds headers + response code)

    Posted 12/07/20 09:12 AM

    Ok. I think I misunderstood your issue. So the value that you extract from url-open response contains the added extra info?

    --HP



    #DataPower
    #Support
    #SupportMigration


  • 5.  RE: Decryption operation step returning more than just the decrypted value (adds headers + response code)

    Posted 12/07/20 04:16 PM

    No, the OUTPUT context variable the Decrypt action contains that extra info. I'm just putting the OUTPUT into a url-open call during the next action. I'm sorry, when I mentioned the url-open, I think I made it confusing, I should have left that part out of my question, ultimately this has very little to do with any url-open call



    #DataPower
    #Support
    #SupportMigration


  • 6.  RE: Decryption operation step returning more than just the decrypted value (adds headers + response code)

    Posted 12/08/20 06:38 AM

    Ok. It is a bit hard to say anything when not able to see your service cfg and policy flows. I've seen similar behavior when using non-xml as request or response type without any policy actions that would handle the parsing of input correctly. A bit confusing explanation, and this probably isn't the case here.

    If the services are exactly the same and the only difference is the firmware version, I'd first try with a newer firmware and then open a PMR if the behavior persists.


    --HP



    #DataPower
    #Support
    #SupportMigration


Related Content