IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

  • 1.  Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/19/20 09:31 AM
    I want to integrate an application which supports only OpenID Connect. I have ISAM 9.0 deployed.

    Under federation , I found OpenID Connect protocol. Can someone please provide any link to follow to accomplish this.

    Thanks

    ------------------------------
    UsmanAli Shaik
    ------------------------------


  • 2.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/20/20 02:29 AM
    Hallo Usman,
    the following link deskribierst Hof to Integrated IGI and ISAM with OIDC. IGI Wolldecke be your app. Schuld give you the  requested Info.

    https://community.ibm.com/community/user/security/blogs/madhura-damare1/2019/10/25/configure-isam-906-as-external-oidc-with-igi

    ------------------------------
    Jens Petersen
    ------------------------------



  • 3.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/20/20 05:02 AM
    Thanks for the link shared.

    Initial lines itself says "ISAM OIDC functionality is available from version 9.0.4 onwards". But, I am working on 9.0.0

    I am working on 9.0.0 , in Secure Federation --> Federation.  There are two protocols 

    SAML and OpenID Connect. 

    Does it mean that isam 9.0.0 can not be an OpenID Connect Operator (OP) (Identity Provider) , provide authentication to any target application support OIDC?

    Thanks,
    Usman

    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 4.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/20/20 05:30 AM
    OIDC in ISAM is available since 9.0.0  see this https://www.ibm.com/blogs/security-identity-access/the-history-of-support-for-openid-connect-in-isam/

    and if I'm not wrong I did that OIDC sso time ago with an ISAM earlier than 9.0.4.0. You may have some problem to follow that blog since ISAM OIDC configuration is different but the concepts are more or less the same

    ------------------------------
    Gianluca Gargaro
    IBM
    Roma
    ------------------------------

    Original Message


  • 5.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/20/20 06:45 AM
    Thanks for adding Gargaro,

    Its very important otherwise we may communicate wrong information with customers. 
    Thanks a lot for the important information. 

    The information in blog you shared is showing supported but this one is saying "ISAM OIDC functionality is available from version 9.0.4 onwards". 
     https://community.ibm.com/community/user/security/blogs/madhura-damare1/2019/10/25/configure-isam-906-as-external-oidc-with-igi


    Its decision making point for an application integration (which supports OpenID Connect) > Application is FSM (Field Service Management from IFS World vendor)

    Current ISAM is 9.0.0.1. I can see the OpenID Connect protocol under Federation module only not in AAC.

    From where we can select as OP or RP (Replying Party)

    Thanks,
    Usman

    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 6.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/25/20 09:16 AM
    Edited by Geethanjali D 02/25/20 10:19 AM
    Hey Usman,

    The following link contains details on Legacy OIDC (OIDC available under Secure Federation --> Federation) and configuring an OIDC OP and RP.
    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/config/concept/con_oidc_support.html

    As mentioned in the article, 'OpenID Connect federations that were created with Security Access Manager Version 9.0.3 and older are legacy federations. The legacy federations do not have the enhanced features that Security Access Manager added in Version 9.0.4 for OIDC Providers and OIDC Relying Party federations'. It would be good to upgrade ISAM to a newer version to use Open ID Connect and API protection instead!

    ------------------------------
    Geethanjali D
    ------------------------------

    Original Message


  • 7.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 02/25/20 09:17 AM
    Hey Usman,

    You can find the link to configuring legacy OIDC, 
    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/config/concept/con_oidc_support.html

    Details on creating OP and RP can be found in the link too. The KC document mentions 'OpenID Connect federations that were created with Security Access Manager Version 9.0.3 and older are legacy federations. The legacy federations do not have the enhanced features that Security Access Manager added in Version 9.0.4 for OIDC Providers and OIDC Relying Party federations'. It would be best for you to upgrade the appliance to 9.0.4 or newer and use the ISAM's newer OpenID Connection.

    ------------------------------
    Geethanjali D
    ------------------------------

    Original Message


  • 8.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 03/02/20 12:03 AM
    Thanks,
    By following the shared link and IBM Federation CookBook: Created OIDC OP Successfully using LMI.

    Working on Configure Reverse Proxy for IdP . In LMI 9.0.0 there is no option for this. We need to run scripts "Using ISAM REST APIs". 

    Federation auto-configuration endpoint
    $ curl -k -v -u admin:Passw0rd -H 'Accept: application/json' -H 'Content-Type:
    application/json' https://isam.myidp.ibm.com/wga/reverseproxy/default/fed_config -d '{
    "runtime":{"hostname":"localhost","port":"443","username":"easuser","password":"Passw0rd"
    },"federation_id":"uuidd36144cb-0152-1a77-9a02-febccb94da75"}'

    There facing challenge with user account "easuser" i.e. password is not with me as it was setup by my colleague and he does not remember it. I am planning to create an another account or reset easuser password and use that to complete Configure Reverse Proxy for IdP . 

    Before that , i am worried about resetting easuser password. Will it impact other configurations!!! Like: in reverse proxy this user easuser configured/being used. Can anyone confirm please two points

    1) No issues , we can go ahead and reset easuser password or no?
    2) Create another account and use that to complete my task "Configure Reverse Proxy for IdP" ?

    Here another thing is , as I am running the above mentioned command from my workstation from where all required network ports are open to all ISAM URLs. But, do i need to have certificates also in my workstations to execute this command ? as connecting to ISAM Federation Runtime over 443 (SSL)

    Thanks,
    Usman

    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 9.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 03/02/20 05:16 AM
    Hi Usman,

    My first comment here is that you (and your customer) should seriously consider upgrading your ISAM system to a later version.  Running version 9.0.0.0 means that you are missing many security and defect fixes.  Latest version is ISAM 9.0.7.1 IF3.  If you were to upgrade to a recent version you would be able to use the newer OIDC capability which is much more flexible and also easier to configure.

    If you want to continue with the legacy OIDC support in ISAM 9.0.0.0, let me try to answer your questions.

    If you reset the password for the "easuser" you may well have issues because this password may be used in numerous places throughout the ISAM system.  For example:
      - BA Header sent on junctions to AAC or Federation endpoints (configured in junction management)
      - Authentication to AAC Authorization Endpoint (configured in WebSEAL configuration file)
      - Authentication to SCIM endpoint (configured in Server Connections)
    It would probably be safer to create a new user (in same place that easuser is defined) and use this instead for new use cases.

    For using cURL, the -k flag (which is included in the example you've given) tells it to bypass certificate checks for secure connections.  There is a security implication here (you're not checking the server identity) but that is the quickest approach to getting a connection to work.

    I hope this helps.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 10.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 03/02/20 11:15 PM

    Hi Jon,

    yes , I have been reported by national cyber security authority also with vulnerability for ISAM9.0.6 itself .
    Upgraded current version 9.0.0 in lower environments and waiting for management go ahead for production.
    Unfortunately it's stuck there.

    Meanwhile I got this application supports only openid connect so trying to achieve as much as facilitated with current version.

    Can we set step up / 2FA POP for openid connect based integrated app ? where as for SAML Based integrations, We can not apply 2FA POP for a specific SAML based app (Not on all SAML Based integrated apps) on 9.0.0 . This we can achieve in higher version ( We can apply 2FA POP on requires specific SAML based app only) instead of applying on junction /fim .
    Is it the same limitation for OIDC or we can apply 2FA POP for a specific Replying Party (RP)?

    Thanks,
    Usman



    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 11.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 03/03/20 03:37 AM
    Hello Usman,

    The ability to implement policies on a per-partner basis was added to Access Manager as "Access Policies".  This is the ability to code to a JavaScript exit during federation flows.   The JavaScript has access to all of the context for the single sign-on request and can return one of a number of outcomes: (1) continue (2) deny (3) redirect for authentication.

    Access Policies are not available at 9.0.0.0.  I think they were added in 9.0.4.0 (same time as new OIDC capability).  I don't think there's a way to do partner level policies with the old OIDC capability you're using in 9.0.0.0.

    Here's an OIDC course on Security Learning Academy.  It has a section on Access Policies:
    https://www.securitylearningacademy.com/course/view.php?id=3307

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 12.  RE: Request for guideline to use OpenID Connect Mechanism where ISAM is IDP

    Posted 04/14/20 06:08 AM
    Hi Folks,

    I could fix the issue with configuring the ISAMOP federation using postman. The issue was , i was trying the curl command from a machine from where 443 (run-time port) was open but still it was giving error. then i ran the curl command from a jump server via which I got access to LMI and etc. Then it went through successful.

    I will go through the link shared by Jon. The target app i am trying is certified by Azure AD and AD FS only. but , I would like to do a poc as the app is OpenID Connect Protocol supported.

    Thanks,
    usman

    ------------------------------
    Rahil Anwar
    ------------------------------

    Original Message


Related Content