Hi,

I need to set some headers depends on source IP of request. I try to use http-transformation (request) for that purpose. I configured credential attribute I whant to see in the rule input:

cred-attr-name = AZN_CRED_IP_FAMILY_AF_INET
cred-attr-name = AZN_CRED_PRINCIPAL_NAME
cred-attr-name = AZN_CRED_AUTHZN_ID
cred-attr-name = AZN_CRED_PRINCIPAL_UUID
cred-attr-name = AUTHENTICATION_LEVEL
cred-attr-name = AZN_CRED_NETWORK_ADDRESS_STR

but I don´t get those values in the rule engine:

<?xml version="1.0" encoding='UTF-8'?>
<HTTPRequest>
<Credential>
<Attributes>
<Attribute name="AZN_CRED_IP_FAMILY_AF_INET"/>
<Attribute name="AZN_CRED_PRINCIPAL_NAME"/>
<Attribute name="AZN_CRED_AUTHZN_ID"/>
<Attribute name="AZN_CRED_PRINCIPAL_UUID"/>
<Attribute name="AUTHENTICATION_LEVEL"/>
<Attribute name="AZN_CRED_NETWORK_ADDRESS_STR"/>
</Attributes>
</Credential>
<RequestLine>
...
...


In the log I see
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:841: ENTER XMLHTTPMessage::doCredentialAttributes
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:892: no credential available
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:892: no credential available
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:892: no credential available
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:892: no credential available
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:892: no credential available
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:892: no credential available
src/pdweb/webseald/http/transformation/XMLHTTPMessage.cpp:900: END XMLHTTPMessage::doCredentialAttributes


I can´t understend why are these credentials are not available. They exist in the credentials, I can see them in /mobile-demo/diag/ application.


Regards,
Ivan

------------------------------
Ivan Yartsev
------------------------------

A bit of a wild guess but please check force-tag-value-prefix is set to no.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Ivan,

How are you triggering the http transformation rule?  The rule needs to be triggered by a POP rather than a request line match in order for the credential to be made available to the transformation rule.  Here is an extract from the WebSEAL configuration file:

#
# The request-match configuration entry is used to define the pattern to be
# matched against the HTTP request line, which includes method, URI, and
# protocol. If a match is successful, then a HTTP transformation is triggered.
#
# Format is:
# request-match = {request|response}:<request-line>
#
# The entry must begin with either request or response, which indicates whether
# the processing is conducted on the HTTP request or response.
# <request-line> contains the request line to be matched against. The pattern
# matching is case-sensitive. Wildcard characters * and ? can be used.
# This entry is optional. Multiple entries can be specified if needed.
#
# You also have the option of matching a request using a host header, useful
# when selectively enabling this functionality for a particular virtual host
# junction. To selectively match an entry based on a particular host header
# the <request-line> should be prepended with the string: [<host>].
#
# Please note that if you use this mechanism to match the request to a rule
# the evaluation of the rule will occur early in the request processing which
# means that credential attributes will not be available in the evaluation of
# the rule. If you need to use credential attributes in your request
# transformation you should use the alternative POP mechanism for invoking the
# rule.
#
# For example:
# request-match = request:GET /index.html HTTP/1.1
# request-match = response:GET /jct/*
# request-match = response:[www.ibm.com]GET /login/*
#
request-match =

I suspect that you are triggering the rule using the 'request-match' configuration entry rather than via a POP.

Thanks,

Scott.

------------------------------
Scott Exton
IBM
Gold Coast
------------------------------

Hi Scott,

Thank you very much! That was the thing.

Regards,
Ivan

------------------------------
Ivan Yartsev
------------------------------

Original Message:
Sent: Thu June 13, 2019 02:58 AM
From: Scott Exton
Subject: HTTP-transformations: get source IP in the rule

Ivan,

How are you triggering the http transformation rule?  The rule needs to be triggered by a POP rather than a request line match in order for the credential to be made available to the transformation rule.  Here is an extract from the WebSEAL configuration file:

#
# The request-match configuration entry is used to define the pattern to be
# matched against the HTTP request line, which includes method, URI, and
# protocol. If a match is successful, then a HTTP transformation is triggered.
#
# Format is:
# request-match = {request|response}:<request-line>
#
# The entry must begin with either request or response, which indicates whether
# the processing is conducted on the HTTP request or response.
# <request-line> contains the request line to be matched against. The pattern
# matching is case-sensitive. Wildcard characters * and ? can be used.
# This entry is optional. Multiple entries can be specified if needed.
#
# You also have the option of matching a request using a host header, useful
# when selectively enabling this functionality for a particular virtual host
# junction. To selectively match an entry based on a particular host header
# the <request-line> should be prepended with the string: [<host>].
#
# Please note that if you use this mechanism to match the request to a rule
# the evaluation of the rule will occur early in the request processing which
# means that credential attributes will not be available in the evaluation of
# the rule. If you need to use credential attributes in your request
# transformation you should use the alternative POP mechanism for invoking the
# rule.
#
# For example:
# request-match = request:GET /index.html HTTP/1.1
# request-match = response:GET /jct/*
# request-match = response:[www.ibm.com]GET /login/*
#
request-match =

I suspect that you are triggering the rule using the 'request-match' configuration entry rather than via a POP.

Thanks,

Scott.

------------------------------
Scott Exton
IBM
Gold Coast
------------------------------