Hi All,

As per the below i can add extra headers to the AAC response message. I have tried the same scenario in the template files in AAC and no extra headers have been added. Can any one show me a clear example of how to do this.



https://www.ibm.com/support/knowledgecenter/en/SSPREK_9.0.6/com.ibm.isam.doc/config/reference/template_file_scripting_aac.html

Thanks and Regards,

------------------------------
Hossam Shebl
------------------------------

Hi Hossam,

Lets take the example of invoking a TOTP policy.
https://192.168.42.102/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:totp&Target=https://192.168.42.102

If I do not have a user session and it results in a server error(Template Page-> C/authsvc/server_error.html) , If I were to change the response "Content-Type" header to application/json.

I add the following piece of code to C/authsvc/server_error.html
<%templateContext.response.setHeader("Content-Type","application/json");%>

The resulting response headers when the TOTP policy invoked.

HTTP/1.1 200 OK
content-language: en-US
content-type: application/json
date: Tue, 26 Nov 2019 02:35:44 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
server: IBM Security Access Manager
transfer-encoding: chunked
x-frame-options: SAMEORIGIN
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubDomains

I hope this helps.

------------------------------
Sumana Narasipur
------------------------------

Hi Sumana,

Thanks alot for your kind reply. It was really helpful. I just noticed that this is not working when invoking the policy using /mga/sps/apiauthsvc and it is working when invoking it using /mga/sps/authsvc and i am not sure if this is the normal case or not. so can you please let me know if there is any workaround to make this is working.

Thanks and Regards,

------------------------------
Hossam Shebl
------------------------------

Original Message:
Sent: Mon November 25, 2019 10:26 PM
From: Sumana Narasipur
Subject: ISAM| Template Page Scripting in AAC

Hi Hossam,

Lets take the example of invoking a TOTP policy.
https://192.168.42.102/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:totp&Target=https://192.168.42.102

If I do not have a user session and it results in a server error(Template Page-> C/authsvc/server_error.html) , If I were to change the response "Content-Type" header to application/json.

I add the following piece of code to C/authsvc/server_error.html
<%templateContext.response.setHeader("Content-Type","application/json");%>

The resulting response headers when the TOTP policy invoked.

HTTP/1.1 200 OK
content-language: en-US
content-type: application/json
date: Tue, 26 Nov 2019 02:35:44 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
server: IBM Security Access Manager
transfer-encoding: chunked
x-frame-options: SAMEORIGIN
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubDomains

I hope this helps.

------------------------------
Sumana Narasipur
------------------------------

Hello Hossam,

The template file scripting does not effect the '/apiauthsvc' endpoint because that endpoint does not use template files as of 9.0.7.0 IF1.

I made the following HTTP Transformation to customize some of the errors that are received :
https://github.com/IBM-Security/isam-support/blob/master/config-example/webseal/http-transformations/response/response-isam9070-customize-apiauthsvc-errors.xslt

But right now you can't use template file scripting for the '/apiauthsvc'.

------------------------------
JACK YARBOROUGH
------------------------------

Original Message:
Sent: Tue November 26, 2019 08:51 AM
From: Hossam Shebl
Subject: ISAM| Template Page Scripting in AAC

Hi Sumana,

Thanks alot for your kind reply. It was really helpful. I just noticed that this is not working when invoking the policy using /mga/sps/apiauthsvc and it is working when invoking it using /mga/sps/authsvc and i am not sure if this is the normal case or not. so can you please let me know if there is any workaround to make this is working.

Thanks and Regards,

------------------------------
Hossam Shebl
------------------------------


Original Message:
Sent: Mon November 25, 2019 10:26 PM
From: Sumana Narasipur
Subject: ISAM| Template Page Scripting in AAC

Hi Hossam,

Lets take the example of invoking a TOTP policy.
https://192.168.42.102/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:totp&Target=https://192.168.42.102

If I do not have a user session and it results in a server error(Template Page-> C/authsvc/server_error.html) , If I were to change the response "Content-Type" header to application/json.

I add the following piece of code to C/authsvc/server_error.html
<%templateContext.response.setHeader("Content-Type","application/json");%>

The resulting response headers when the TOTP policy invoked.

HTTP/1.1 200 OK
content-language: en-US
content-type: application/json
date: Tue, 26 Nov 2019 02:35:44 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
server: IBM Security Access Manager
transfer-encoding: chunked
x-frame-options: SAMEORIGIN
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubDomains

I hope this helps.

------------------------------
Sumana Narasipur