Is anyone aware if the webseal configuration to utilize the RTSS (not sure if this is considered EAS), for example specifically servers listed in tfim-cluster and rtss-cluster stanzas, will send the hostname in the TLS SNI header?

I know I can get SNI working on the junction going to the RTSS as we can with any other backend that we can do this today.  But integrating with RTSS for OAuth and MFA purposes is a bit more than just the junction and of course have a different configuration inside the webseal conf file.

I have not tested this yet, but what I want to know this information for is if I can place the ISVA runtime behind an OpenShift SSL passthrough route, which utilize SNI.  We use these today on our dev environments for getting traffic into our web reverse proxy instances, since the client browsers do send the SNI header, and it works great even with x509 mTLS client cert authentication.  However, I have a need to place the runtime behind one of these routes to try to eliminate some extra networking we are currently utilizing to expose the runtime via other methods to allow traffic from webseals in one network to get to the runtime in a different network.

I know for DSC this will not work (unless it has changed in future versions).  In the past I tried to place the DSC servers behind a passthrough route and webseal could not reach the DSC servers/instances.  I always suspected this was because webseal was not sending the SNI header more than likely when contacting the DSC.  So this is why I am specifically asking about runtime right now (although if this has changed for DSC please let me know, that would be another one I can utilize the passthrough routes for).

Thanks for any input!

Matt

Is anyone aware if the webseal configuration to utilize the RTSS (not sure if this is considered EAS), for example specifically servers listed in tfim-cluster and rtss-cluster stanzas, will send the hostname in the TLS SNI header?

I know I can get SNI working on the junction going to the RTSS as we can with any other backend that we can do this today.  But integrating with RTSS for OAuth and MFA purposes is a bit more than just the junction and of course have a different configuration inside the webseal conf file.

I have not tested this yet, but what I want to know this information for is if I can place the ISVA runtime behind an OpenShift SSL passthrough route, which utilize SNI.  We use these today on our dev environments for getting traffic into our web reverse proxy instances, since the client browsers do send the SNI header, and it works great even with x509 mTLS client cert authentication.  However, I have a need to place the runtime behind one of these routes to try to eliminate some extra networking we are currently utilizing to expose the runtime via other methods to allow traffic from webseals in one network to get to the runtime in a different network.

I know for DSC this will not work (unless it has changed in future versions).  In the past I tried to place the DSC servers behind a passthrough route and webseal could not reach the DSC servers/instances.  I always suspected this was because webseal was not sending the SNI header more than likely when contacting the DSC.  So this is why I am specifically asking about runtime right now (although if this has changed for DSC please let me know, that would be another one I can utilize the passthrough routes for).

Thanks for any input!

Matt