Hello!

I've encountered this odd issue where I have two identical rate limiting files as policies, and I've set each one on two different WRP/Webseal instances.

So the only difference would be the name of the policy files in the Webseal config, but their contents are identical.

When load tested I see HTTP 429's on the one WRP URL that is in the DSC, or has a replica set (dsess = enabled) when the capacity and interval are reached.

Although on the other WRP URL where I've applied the same rate limiting config, no limiting ever occurs. This WRP URL is not in the DSC(dsess = disabled).

This is the only difference I can see between the two Webseals, is that one is in the DSC and the other is not.

I am limiting on any method, and using oauth_token_client_id as the limiting factor. I've put that configuration below.

Is it required that a Webseal/WRP needs to have dsess = enabled for rate limiting to take effect?

# Any request matches this criteria - request URL - HTTP method
# Examples GET, POST

resources:
  - url: "*"
    method:
    - "*"

# Limiting is based on the credential being used
credential:
   oauth_token_client_id: "*"

# Credential can be used <interval> times during the <capacity> window in seconds
capacity: 200
interval: 600

To answer your question, no you don't have to use DSC to use rate limiting.