IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Doubt about FSSO

    Posted 01/27/21 06:33 PM
    Hi fellows!

    I'd like some help to configure Forms Based Single Sign-on on my application.

    I created the fsso.conf with the parameters:

    [forms-sso-login-pages]
    login-page-stanza = app1
    login-credential-learning = yes

    [app1]
    login-page = /portalcom/login*
    login-form-response-pattern =
    default-login-form-action = loginForm
    gso-resource = app1
    argument-stanza = args-for-app1
    login-success-pattern = +302[location:*/portalcom/jsp/TelaInicial*]

    [args-for-app1]
    j_username = gso:username
    j_password = gso:password
    AM_username = cred:AZN_CRED_PRINCIPAL_NAME
    Special_Attribute = cred:tagvalue_custom_attribute

    My application has this source code:
    <form method="POST" action="j_security_check" name="loginForm" onsubmit="maiusculas()" >
    <table border=0 align='center' >
    <tr>
    <td>
    <b>Usu&aacute;rio:</b>
    </td>
    <td>
    <INPUT TYPE="text" NAME="j_username">
    </td>
    </tr>
    <tr>
    <td>
    <b>Senha:</b>
    </td>
    <td>
    <INPUT type="password" name="j_password">
    </td>
    </tr>
    <tr><td colspan="3">&nbsp;</td></tr>
    <tr>
    <td>&nbsp;
    </td><td>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
    <nobr><input type="submit" value="Login">
    </nobr>
    <td>
    </tr>
    <tr><td colspan="3">&nbsp;</td></tr>
    <tr><td colspan="3"><font color="#BD1010" face="Helvetica,Verdana,Arial" size="2"><i>Digite seu usu&aacute;rio e senha. O sistema diferencia letras mai&uacute;sculas e min&uacute;sculas</i></font></td></tr>
    </table>
    </form>

    But, the SSO doesnt work yet. what am I doing wrong?

    Regards,

    ------------------------------
    Alexandre Gammaro
    CyberSecurity Especialist
    Triscal
    ------------------------------


  • 2.  RE: Doubt about FSSO

    Posted 01/28/21 01:28 AM

    Hi Alexandre, 

    I believe you need to set login-form-response-pattern - try a value of *. Eg:

    login-form-response-pattern = *

    This thread may also contain several useful details: https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?GroupId=2863&MessageKey=99bd803d-5ddd-4de6-bfdd-7aa7b2815c57&CommunityKey=e7c36119-46d7-42f2-97a9-b44f0cc89c6d&tab=digestviewer&ReturnUrl=%2Fcommunity%2Fuser%2Fsecurity%2Fcommunities%2Fcommunity-home%2Fdigestviewer%3FCommunityKey%3De7c36119-46d7-42f2-97a9-b44f0cc89c6d

    Hope this helps



    ------------------------------
    Leo Farrell
    ------------------------------



  • 3.  RE: Doubt about FSSO

    Posted 01/28/21 03:56 AM
    Alexandre,

    Looking at your source code, it looks like your form does not directly post data - instead it is calling a JavaScript function.  This makes life a little more interesting but can be OK as long as the JavaScript is only doing format checking and isn't manipulating the login data after submission in a way you can't predict.

    When submission is via JavaScript you must identify the POST target for the form submission manually.  I think you've doing this - assuming that /portalcom/loginForm is that target.

    What I don't see in your config file is a "login-form-action".  This is required in order to identify a page that contains the login form. If think you need to set this to "j_security_check".

    I think the login-form-response-pattern is optional.  However, it is a good idea to have this match login pages (and not match any other pages).  You can use any unique content in the login page for this match.

    Jon.



    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 4.  RE: Doubt about FSSO

    Posted 01/28/21 08:22 AM
    Hi Leo,

    So, i think this parameter login-form-response-pattern is optional.
    But o inputed the * as value.

    Hi Jon,
    Yes, my application call a Servlet to do a login.

    I rectified the fsso conf with these parameters bellow:
    [forms-sso-login-pages]
    login-page-stanza = app1
    login-credential-learning = yes

    [app1]
    login-page = /portalcom/login*
    login-form-response-pattern = *
    login-form-action = j_security_check
    default-login-form-action = j_security_check
    gso-resource = app1
    argument-stanza = args-for-app1
    login-success-pattern = +302[location:*/portalcom/jsp/TelaInicial*]

    [args-for-app1]
    j_username = gso:username
    j_password = gso:password
    AM_username = cred:AZN_CRED_PRINCIPAL_NAME
    Special_Attribute = cred:tagvalue_custom_attribute

    I dont understand, what is it for this 2 parameters AM_username and Special_Attribute


    ------------------------------
    Alexandre Gammaro
    CyberSecurity Especialist
    Triscal - agammaro@triscal.com.br
    ------------------------------

    Original Message


  • 5.  RE: Doubt about FSSO

    Posted 01/29/21 04:03 AM
    > I dont understand, what is it for this 2 parameters AM_username and Special_Attribute

    These are just examples in the template on how to provision fields with values coming from the credential of the user (in addition or in place of values contained in a GSO).

    As these don't apply to your situation you can delete them.

    ------------------------------
    Laurent LA Asselborn
    ------------------------------

    Original Message


  • 6.  RE: Doubt about FSSO

    Posted 01/29/21 02:55 PM
    Ahh.. ok...
    Great..

    But i still with issues to do SSO on my application.

    ------------------------------
    Alexandre Gammaro
    CyberSecurity Especialist
    Triscal - agammaro@triscal.com.br
    ------------------------------

    Original Message


Related Content