Hi all,

I'm currently playing with the Quick Connect profiles and I'm facing an interresting situation.
While my point of contact is defined as "https://<myhost>/isam/sps", my endpoints urls are egal to "https://<myhost>/isam/sps/saml20idpqc/saml20/sps/saml20idpqc/saml20/...".
See the repitition of the "sps/saml20idpqc/saml20/"
Any idea where this repitition could come from?
I'm using v9.0.7.1
Thanks for your remarks

------------------------------
Emmanuel Fauconnier
------------------------------

Hello Emmanuel,

I'm not 100% sure but your POC endpoint looks suspicious. I think it should only include the hostname and junction name -but you seem to have added sps on the end?

Can you redefine as https://<my host>/isam ?

Also, did you create the /isam junction?  I assume it is a standard junction?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Jon,
As I suspected something, I used the REST API to extract the information (https://{appliance_hostname}/iam/access/v8/federations/{federation_id}).
The values are consistent (as expected) between the LMI and the REST as:
Federation name = saml20idpqc
Point of contact = https://<myhost>/isam (where ISAM will append the /sps)
The /isam junction is a standard (Stateful Junction, SSL, all default values)

------------------------------
Emmanuel Fauconnier
------------------------------

Original Message:
Sent: Sun July 19, 2020 01:52 PM
From: Jon Harry
Subject: Quick connect

Hello Emmanuel,

I'm not 100% sure but your POC endpoint looks suspicious. I think it should only include the hostname and junction name -but you seem to have added sps on the end?

Can you redefine as https://<my host>/isam ?

Also, did you create the /isam junction?  I assume it is a standard junction?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Emmanuel!

Would you be able to access the Fed runtime directly (might need to expose it to listen on an external IP, and use 'easuser' on the basic authentication prompt) to look at the /Info/InfoServiceXML endpoint?
This will give summary of the endpoints known by the AAC/Fed component.

This would be a good starting point, to see if the duplication already happens on the AAC/Fed component, or if somehow the Reverse Proxy introduces it.

Best regards,
Hans


------------------------------
HANS VANDEWEGHE
------------------------------

Hi Hans, good idea.
An example of a "standard" federation without issue
<federation id="..." name="saml20sp" protocolType="SAML20" spsPath="/isam/sps">
<partner name="SP ISAM DEV" protocolId="https://<myhost>/isam/sps/saml20sp/saml20" role="sp" self="true">
<endpoints>
<endpoint index="0" type="SAML2.SingleLogoutServiceInit" value="https://<myhost>/isam/sps/saml20sp/saml20/sloinitial"/>
And the Quickconnect federation with the issue :
<federation id="uuid247872c0-0173-1452-8107-a19c0939f9af" name="saml20idpqc" protocolType="SAML20" spsPath="/isam/sps">
<partner name="IBM Quick Connect" protocolId="https://<anotherhost>/isam/sps/saml20idpqc/saml20/sps/saml20idpqc/saml20" role="ip" self="true">
<endpoints>
<endpoint binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" index="0" type="SAML2.SingleSignOnService" value="https://<anotherhost>/isam/sps/saml20idpqc/saml20/sps/saml20idpqc/saml20/login"/>
The information is equivalent to the one I extracted vie the API.

------------------------------
Emmanuel Fauconnier
------------------------------

Original Message:
Sent: Mon July 20, 2020 05:24 AM
From: HANS VANDEWEGHE
Subject: Quick connect

Hi Emmanuel!

Would you be able to access the Fed runtime directly (might need to expose it to listen on an external IP, and use 'easuser' on the basic authentication prompt) to look at the /Info/InfoServiceXML endpoint?
This will give summary of the endpoints known by the AAC/Fed component.

This would be a good starting point, to see if the duplication already happens on the AAC/Fed component, or if somehow the Reverse Proxy introduces it.

Best regards,
Hans

------------------------------
HANS VANDEWEGHE
------------------------------