IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Response code 502 using AAC policy and http/2

    Posted 11/03/21 07:22 AM

    Hi

    We plan to use an AAC policy to ensure a certain authentication level for resources.

    When using http/2 we get a response code 502 - bad gateway

    It works fine with http/1.1 requests.

    When using http/2 but with no policy attached, it also works fine (except for the missing authentication level validation).

    Are there any caveats using AAC policies in combination with http/2 ?

     

    BR, Carsten



    ------------------------------
    Carsten Jensen
    ATP
    +4530595704
    ------------------------------


  • 2.  RE: Response code 502 using AAC policy and http/2

    Posted 11/04/21 04:18 AM
    Hi Carsten,

    I'm not aware of any caveats.  I asked around a bit but the consensus is that you'll probably need a support case to get to the bottom of this.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Response code 502 using AAC policy and http/2

    Posted 11/05/21 06:54 AM
    Hi
    In the environment (preprod.) using http/2 the RP and the fedruntime runs on 2 different ISAMs. On the http/1.1 environment both runs on the same ISAM (a dev environment)

    Does the AAC license need to be actvated on the fedruntime ISAM also? (It's only activated on the RP ISAM)

    I get these loggings from the pdweb.rtss.log, as if something is missing on/in the fedruntime
    thread 56 is "my" call, and thread 57 is a ping getting a 404
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:9 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPCall.cpp:107: Executing SOAP Call: EvaluateRTSSRequest

    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:9 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPCluster.cpp:537: AMWSOAPCluster::getMember(): Called

    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:4 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPCluster.cpp:688: AMWSOAPCluster::getMember(): No available members at any Pri!

    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:2 /build/isam/src/i4w/pdweb/rba/RTSSModule.cpp:965: Could not communicate with RTSS.
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/rtss_eas.cpp:539: Enter rtss_eas_cleanup
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/rtss_eas.cpp:550: Exit rtss_eas_cleanup
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPClusterMember.cpp:849: Cluster member poll thread: Pinging member: URL https://fed-runtime:10443/rtss/authz/services/AuthzService

    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPCluster.cpp:1005: AMWSOAPCluster::pingMember(): Called

    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPCall.cpp:107: Executing SOAP Call: ping

    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdwebrte/soap/AMWSOAPHandleMgr.cpp:312: Located a SOAP handle for thread: 0x7f3c49965700

    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:158: Enter RTSSPingCall::soapCall
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:174: About to ping RTSS service using: https://fed-runtime:10443/rtss/authz/services/AuthzService
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:478: Enter RTSSPingCall::parseURL
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:485: About to parse service URL [https://fed-runtime:10443/rtss/authz/services/AuthzService] into its URL, host, and port components
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:502: Found URL: /rtss/authz/services/AuthzService
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:348: Enter extractHostAndPort hostAndPort[fed-runtime:10443] useSSL[1]
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:414: extractHostAndPort: host [fed-runtime]
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:430: Found Port: 10443
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:453: extractHostAndPort: port [10443]
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:456: Exit extractHostAndPort result[0x0] host[fed-runtime] port[10443]
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:509: RTSSPingCall::parseURL: Found Host: (fed-runtime) port (10443)
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:516: Exit RTSSPingCall::parseURL (0x0)
    2021-11-05-08:21:20.471+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:191: Parsed the service URL: fed-runtime:10443 /rtss/authz/services/AuthzService
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSModule.cpp:1225: Enter RTSSModule::constructResponse
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSModule.cpp:1309: Exit RTSSModule::constructResponse (0x0)
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSModule.cpp:999: Exit RTSSModule::authorize (0x0)
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSRequest.cpp:243: Enter RTSSRequest::~RTSSRequest
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/RTSSRequest.cpp:244: Exit RTSSRequest::~RTSSRequest
    2021-11-05-08:21:20.471+01:00I----- thread(56) trace.pdweb.rtss:6 /build/isam/src/i4w/pdweb/rba/rtss_eas.cpp:434: Exit process (0x0)
    2021-11-05-08:21:20.472+01:00I----- thread(56) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/rtss_eas.cpp:521: rtss-eas azn_svc_decision_access_allowed_ext EXIT status[0]
    2021-11-05-08:21:20.472+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:254: About to send the request: GET /rtss/authz/services/AuthzService HTTP/1.1
    User-Agent: IBM Tivoli Access Manager (WebSEAL)
    Host: fed-runtime
    Authorization: Basic ZWFzdXNlcjpBVFBQaWwwZWFzdXNlcg==
    Accept: */*


    2021-11-05-08:21:20.479+01:00I----- thread(57) trace.pdweb.rtss:9 /build/isam/src/i4w/pdweb/rba/RTSSSOAPCall.cpp:313: Got ping response (1023):
    HTTP/1.1 404 Not Found
    Connection: Close
    Content-Type: text/html; charset=UTF-8
    Content-Length: 29429
    Date: Fri, 05 Nov 2021 07:21:20 GMT

    BR Carsten

    ------------------------------
    Carsten Jensen
    ATP
    +4530595704
    ------------------------------

    Original Message


  • 4.  RE: Response code 502 using AAC policy and http/2

    Posted 11/05/21 02:10 PM
    Hi Carsten,

    Usually AAC Runtime and Fed Runtime are co-located because they both run within the same Web App Server on the appliance.  The pattern I've always envisaged is Web Reverse Proxy on one appliance (often in DMZ) and then AAC and Fed Runtimes on another appliance (in a more secure zone).

    It sounds like you have Reverse Proxy and AAC Runtime on one appliance and Fed Runtime on another.

    If that's the case you would need to be really careful that all AAC-related traffic is being directed to the local runtime where AAC is enabled and that Federation traffic is being directed to the remote runtime where Federation runtime is running.  I personally have never set up a system in that way so I can't comment on whether there are any limitations or issues with this architecture.

    I would say that if, for example, AAC-related traffic or connections end up at the federation runtime Not Found errors or Not authorized errors would be likely symptoms.

    I assume you have two junctions on your Reverse Proxy - one for AAC and one for federation.  I would check Reverse Proxy logs to make sure that AAC-related requests are not being directed to the federation junction (or vica versa).

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 5.  RE: Response code 502 using AAC policy and http/2

    Posted 11/08/21 07:41 AM

    Hi Jon

    Thanks for your reply.

    Let me clarify

    In the preprod. environment (the one using http/2 – which is probably not the issue) the AAC runtime and the federation runtime are located on the same appliance. On this appliance the AAC licence is not activated.

    The RP runs on another appliance in another zone. On this appliance the AAC licence is activated and the wizard (Authentication and context based Access Configuration) was run for the RP instance pointing to the other appliance (host and port as the federation runtime).

     

    Does the AAC license need to be activated on the AAC/fed runtime ISAM also? I can see there is actually no logs for "access_control" under application log files.

     

    Another question; should there be requests to the created /mga junction on the RP?

    BR, Carsten



    ------------------------------
    Carsten Jensen
    ATP
    +4530595704
    ------------------------------

    Original Message


  • 6.  RE: Response code 502 using AAC policy and http/2

    Posted 11/08/21 08:23 AM
    Hi Carsten,

    If the AAC and Federation runtime are on the same appliance, that appliance needs to have both the AAC and Federation add-ons activated.  If it does not, AAC requests sent to that appliance will result in Not Found or Not Authorized responses.

    You say that you have activated the AAC add-on on your Reverse Proxy appliance.  That was probably not required - it is simply a Reverse Proxy which is going to connect to a remote AAC/Fed instance.  Only base licence required for that.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 7.  RE: Response code 502 using AAC policy and http/2

    Posted 11/09/21 06:03 AM
    Hi Jon
    That did the trick (AAC license activated on the AAC/fed runtime ISAM ). Now it works.

    When is the created junction /mga used?

    BR Carsten

    ------------------------------
    Carsten Jensen
    ATP
    +4530595704
    ------------------------------

    Original Message


  • 8.  RE: Response code 502 using AAC policy and http/2

    Posted 11/15/21 05:39 AM
    Hi Carsten,

    Very happy to hear you have things working.

    The /mga junction is typically created when configuring a Reverse Proxy to act as the "point of contact" for the AAC Runtime.  This junction is used by clients wanting to access the authentication service and by clients wanting to access OAuth/OIDC Provider endpoints.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


Related Content