IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  InfoMap authentication mechanism

    Posted 06/22/26 02:40 PM
     
     
    Hello Team,
     
    I have a requirement to invoke an external REST API from an InfoMap authentication mechanism.
     
    Rather than hardcoding the API endpoint and API key within the InfoMap mapping rule, I would like to understand the recommended approach for managing and retrieving these values securely.
     
    Our Verify Access deployment is running in a Kubernetes environment. What are the best practices for externalizing API endpoints and secrets (for example, using Kubernetes Secrets, ConfigMaps, Server Connections, or other supported mechanisms) and accessing them from an InfoMap?
     
    Any guidance, examples, or recommended patterns would be greatly appreciated.

    Regards
    SRK


    ------------------------------
    Someswara Reddy Karem
    ------------------------------


  • 2.  RE: InfoMap authentication mechanism

    Posted 06/23/26 08:24 AM

    This may be of interest to you.  I saw it in the 11.0.3.0 What's New notes:

    • Access Kubernetes ConfigMaps and system environment properties in JavaScript mapping rules

      The KubernetesUtils class can now allow admins to access Kuberentes ConfigMaps and system environment properties from the JavaScript Mapping Rules. For more information, see JavaScript allowlist.

    Apparently you can use com.tivoli.am.fim.trustserver.sts.utilities.KubernetesUtils to query ConfigMaps and environment properties.  I am not sure about secrets, as I have not looked into it.  I would be interested in what you end up doing here.  If anyone has any examples of this class being used, it would be appreciated to see one or two.

    In the past, I've used server connections and setup the credentials there and then used them from the mapping rules.  Can you go that method, or are your credentials and/or endpoints changing depending on the requests?



    ------------------------------
    Matt Jenkins
    ------------------------------



Related Content