IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Infomap authenticator - Virtual junction

    Posted 11/07/22 04:39 PM
    Hi,

     I have a requirement to build customer authenticator using infoMap and perform OTP using in-build MAC OTP mechanism. I have tested the flow and successfully logged into application using Standard junction. Now I have to create Virtual junction for the same requirement. I haven't worked on virtual junction till now.. Is there any specific configuration or concepts I should be aware of using Virtual junction over standard junction?

    ------------------------------
    Mahi
    ------------------------------


  • 2.  RE: Infomap authenticator - Virtual junction

    Posted 11/08/22 01:41 AM
    The use case you describe doesn't really make sense for virtual host junctions, since with a virtual host junction the reverse proxy routes all requests matching the virtual host (website hostname) to the one backend server, and the idea of having other junctions, such as one to AAC for an infomap-based EAI, doesn't exist.

    ------------------------------
    Shane Weeden
    IBM
    ------------------------------



  • 3.  RE: Infomap authenticator - Virtual junction

    Posted 11/08/22 09:51 AM
    Edited by Mahi 11/08/22 09:51 AM
    @Shane Weeden

    Thanks for your response. I'm sorry, I wasn't clear on the use case before

    ------------------------------
    Mahi
    ------------------------------

    Original Message


  • 4.  RE: Infomap authenticator - Virtual junction

    Posted 11/08/22 08:37 AM

    To be able to use your/mga junction together with your virtual host junction (to enable AAC), you can try to set match-vhj-first to no.   This reverses the standard matching mechanism (where everything is sent to the backend server automatically), and will check your other junctions first. 
    In webseald.conf, you can set this:

    [junction]
match-vhj-first = no  

[session] 
shared-domain-cookie = yes

    Note that you can't have any standard junctions that match whatever's in your virtual host junction , because the standard junctions will now take precedence.

    ------------------------------
    Tom Bosmans
    ------------------------------



  • 5.  RE: Infomap authenticator - Virtual junction

    Posted 11/08/22 09:19 AM
    @Tom Bosmans

    Thank you.

    I am directly invoking authentication policy to perform authentication. Once authentication is successfully performed, user request will be forwarded to the application landing page.

    How the redirection uri can be set in the Infomap for a virtual junction? ​

    Since reverse proxy always matches host header to direct the requests to junction server, the host header should be passed from AAC runtime to WGA  or below setting alone will do the trick. 

    context.set(Scope.SESSION, "urn.ibm.security.asf.response.token.attributes", "itfim_override_targeturl_attr","@virtual_host_junction_label/path");


    ------------------------------
    Mahi
    ------------------------------

    Original Message


  • 6.  RE: Infomap authenticator - Virtual junction

    Posted 11/08/22 11:26 AM
    I'm not sure tbh.   
    @virtual_host_junction_label won't do anything, but you try it out with hardcoded urls first.

    ------------------------------
    Tom Bosmans
    ------------------------------

    Original Message


Related Content