Hello,

I am working with on-prem ISAM 9.0.7 and exploring the OAuth Authorization Code flow. As per ISAM MMFA configurations using the wizard on the ISAM LMI, the transaction endpoint created for use by OAuth clients is:

https://<webseal-ip>/scim/Me?attributes=urn:ietf:params:scim:schemas:extension:isam:1.0:MMFA:Transaction:transactionsPending,urn:ietf:params:scim:schemas:extension:isam:1.0:MMFA:Transaction:attributesPending

This transaction endpoint is working fine with one of my ISAM lab environments and showing the following results (which are expected):

{
"meta": {
"location": "https://192.168.10.186/scim/Users/amFoYW56YWli",
"resourceType": "User"
},
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User",
"urn:ietf:params:scim:schemas:extension:isam:1.0:MMFA:Transaction"
],
"id": "amFoYW56YWli",
"urn:ietf:params:scim:schemas:extension:isam:1.0:MMFA:Transaction": {
"attributesPending": [],
"transactionsPending": []
},
"userName": "jahanzaib"
}

However, in another similar ISAM environment (with same configurations) this same endpoint is returning different results as shown below:

{
"meta": {
"location": "http://10.180.142.215:81/scim/Users/c3ZjX3VhdF9pYW1fdXNy",
"resourceType": "User"
},
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"id": "c3ZjX3VhdF9pYW1fdXNy",
"userName": "svc_uat_iam_usr"
}

It can be observed that urn:ietf:params:scim:schemas:extension:isam:1.0:MMFA:Transaction schema is missing in result from the second environment.

What could be causing this difference?

Best regards,

------------------------------
Jahanzaib Sarwar
------------------------------

Hi Jahanzaib,

Have you attempted any MMFA transactions yet?  I have a feeling that the system may not return the additional information until at least one MMFA transaction has been attempted by the user.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Jon,

No MMFA transactions were attempted and this was a new user. You are right, the information is now available in the response after MMFA transactions have been attempted.

Thank you.

Best regards,
Jahanzaib

------------------------------
Jahanzaib Sarwar
------------------------------

Original Message:
Sent: Mon June 29, 2020 04:17 AM
From: Jon Harry
Subject: ISAM: MMFA Transaction Endpoint not returning expected schemas

Hi Jahanzaib,

Have you attempted any MMFA transactions yet?  I have a feeling that the system may not return the additional information until at least one MMFA transaction has been attempted by the user.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------