IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Protecting Runtime Server and STS chains

  • 1.  Protecting Runtime Server and STS chains

    Posted 09/19/19 07:05 AM
    Hello folks,

    I was actually looking for a best practice on how to secure access to the Java runtime from the outside world and guarantee that STS chains are only accessed by authorized applications.

    I do think that this is doable by looking within the SOAP request, validating which clients is reaching the runtime (through their SSL certificate content for which we use Client cert mapping & SSL-MA on a RP for this) and extracting the issuer + appliesTo field to do the matching.

    I think that one way to achieve this is to use Context-Based Access Policies and inspect the POST body. However, I've some difficulties to understand the basics of this configuration (should it be a custom mapping rule being injected in there ? Shall we define each chain as a new separated resource ?).

    Or is there a best way to do it ?

    ------------------------------
    Cedric Servais
    ------------------------------


Related Content