Are multiple ISVA security domains supported on the lightweight containers?  I have a case open with L2 where any request on v10.0.3.0 or v10.0.3.1 using the lightweight containers fails with a 403 forbidden, even when I login as sec_master to the webseal.  The webseal will authenticate the user, but it will not authorize any request.  When I switch the container image to the full verify-access image, without changing any other parameters on the container, just the image, the webseal works and will authorize users and pass traffic without issue.

L2 thinks it could be because we are using security domains other than the default ISVA security domain.  We have multiple administrative security subdomains setup under the default domain, and of course the webseal instance is joined to the security domain the appropriate users exist within to authenticate and authorize.  This has worked fine for over a couple years on containers.  However, now that I built a lab on these lightweight containers, this doesn't seem to work.

I want to make sure the multiple domains are in fact still supported on the lightweight containers, otherwise we have some additional scrambling to do on our end prior to the v10.0.4.0 release in June.

Thanks for your input!

------------------------------
Matt Jenkins
------------------------------

Thanks Scott for confirming this was still supported.  I just updated our L2 case and let them know we need a fix for it prior to v10.0.4.0.  I am currently working on starting to test the lightweight containers to determine what changes we need to make to our manifests, etc. to get them working.  Hence, I need the WRPs working in order to complete testing.  I assume v10.0.4.0 is still targeted for June 24 and I need to complete this testing way ahead of that date.

Do you think this will be able to be applied as a local hotfix file or will it require you all to deploy a new image (i.e. 10.0.3.2)?

Thanks!

------------------------------
Matt Jenkins
------------------------------

Original Message:
Sent: Tue March 01, 2022 01:02 AM
From: Scott Exton
Subject: Multiple ISVA security domains using lightweight containers - Issues with WRP

Matt,

 

The use of multiple ISVA security domains in the lightweight container should definitely still be supported.  I replicated the issue in my local environment and have a fix for the issue.  This fix will be available in the 10.0.4 release, but reach out to the IBM support team if you need a fix sooner than that.

 

Thanks.

 

 

Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor

 

 

Original Message:
Sent: 3/1/2022 8:55:00 AM
From: Matt Jenkins
Subject: RE: Multiple ISVA security domains using lightweight containers - Issues with WRP

Thanks Scott for confirming this was still supported.  I just updated our L2 case and let them know we need a fix for it prior to v10.0.4.0.  I am currently working on starting to test the lightweight containers to determine what changes we need to make to our manifests, etc. to get them working.  Hence, I need the WRPs working in order to complete testing.  I assume v10.0.4.0 is still targeted for June 24 and I need to complete this testing way ahead of that date.

Do you think this will be able to be applied as a local hotfix file or will it require you all to deploy a new image (i.e. 10.0.3.2)?

Thanks!

------------------------------
Matt Jenkins
------------------------------