Hi Patrizio,
The login-success.html page is only shown when login completes but there is not session available. This can happen, for example, if you trigger EAI directly (rather than it being triggered by an ACL or POP) and there's no redirect URL returned in the EAI message.
The normal behaviour for WebSEAL is to redirect you to the originally requested resource after login. So, if you request
https://webseal.com/junction, WebSEAL will show you the login page associated with /junction but after login will redirect you directly back to
https://webseal.com/junction. You won't ever see the login-success.html.
It is possible to force WebSEAL to always redirect to a fixed page after authentication. To do this you would use:
#----------------------
# AUTOMATIC REDIRECT
#----------------------
# Page to which users are automatically redirected after completing a successful
# authentication. The configured URL can contain special macro's which will
# allow dynamic substitution of information from WebSEAL.
#
# The supported macro's include:
# %AUTHNLEVEL% Level at which the session is currently authenticated.
# %HOSTNAME% Fully qualified host name.
# %PROTOCOL% The client connection protocol used. Can be HTTP or HTTPS.
# %URL% The original URL requested by the client.
# %USERNAME% The name of the logged in user.
# %HTTPHDR{<name>}% The value of the specified HTTP header.
# %CREDATTR{<name>}% The value of the specified credential attribute.
#
# The format can either be an absolute URL or server relative URL and can
# include macro information as listed above:
# login-redirect-page = http://www.ibm.com/
# login-redirect-page = /jct/page.html
# login-redirect-page = /jct/page.html?url=%URL%&hdr=%HTTPHDR{Host}%
#
# Please note that in order for the configured login redirect to take affect
# the redirect capability must be enabled for the desired authentication
# mechanisms using the [enable-redirects] stanza.
As it says, you also need to enable redirects for the authentication mechanisms you want to use:
[enable-redirects]
# This stanza contains a list of authentication mechanisms
# for which automatic redirects are enabled.
# Valid choices are forms-auth, token-auth, basic-auth, cert-auth,
# oidc and ext-auth-interface
# Any or all of them may be enabled.
#redirect = forms-auth
#redirect = basic-auth
#redirect = token-auth
#redirect = cert-auth
#redirect = ext-auth-interface
#redirect = oidc
As far as I can tell, there's only on redirect URL per server - it doesn't look like you can change it per junction.
However, you could pass the originally requested URL as a macro in query string and then use client-side script to implement different behaviour based on junction.
Jon.
------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------
Original Message:
Sent: Fri March 04, 2022 04:44 AM
From: Patrizio
Subject: Root Junction Not found
Hi Jon,
I would like to deepen your statement:
"Note that the local junction is intended for storing things like CSS and image assets for custom login pages etc. It is not intended as a place to store large quantities of content."
i'm trying to make a custom login + redirect for a jct (or vhj) but i can't.
I have created a folder in the mgmt with the name of the junction and I can customize the login page.
After login, however, the login_success.html page is not read, which contains the redirect I need.
The 2 two files are in the same folder but only 1 is processed.
The result is that even by logging in with a custom page I find myself inside the index.html of the jct root.
Any idea?
Thanks
------------------------------
Patrizio
------------------------------
Original Message:
Sent: Mon January 04, 2021 07:29 AM
From: Jon Harry
Subject: Root Junction Not found
Hi Joao,
The root junction "/" is a special junction which allows access to web resources that are hosted directly on the Reverse Proxy. There is some configuration but usually a request is sent for processing at the root junction only if the path doesn't match any configured junction.
Putting aside things like junction mapping table and junction cookies, any request that starts /isam/... will be processed by the /isam junction (and forwarded to runtime) and any other request will be processed by the root junction (and return local files).
Note that the local junction is intended for storing things like CSS and image assets for custom login pages etc. It is not intended as a place to store large quantities of content.
Jon.
------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
Original Message:
Sent: Mon January 04, 2021 06:55 AM
From: Joao Goncalves
Subject: Root Junction Not found
Thanks Tushar.
Your reply only partially answered my question.
The difference between / and /isam is given. But I did not understand what you meant by "then all requests for federations or aac will use this junction". Does this mean that when a client access /, it is forward to /isam?
In this case, on the Reverse Proxy Traffic we should not add to get the total!
If that is not the case, then the requests for / are in fact separate to the the /isam junction.
------------------------------
Joao Goncalves
Pyxis, Lda.
Sintra
+351 91 721 4994
Original Message:
Sent: Sun January 03, 2021 11:54 PM
From: Tushar Prasad
Subject: Root Junction Not found
HI
Both junctions have different work
/ -- is the root junction which will provide access to local hosted pages for example, /login and other requests which needs / junction interaction. so these requests, must be showing those requests(pre and post logins if you are dependent on login.html to login the user)
/isam -> is meant for requests which used /isam junction. when /isam is pointing to federation/aac runtime, then all requests for federations or aac will use this junction
total request should be for / and /isam
you are seeing this because you have selected aspect to the junction so it has showed you the grouping based on each junction.
thanks
tushar
thanks
tushar
------------------------------
Tushar
Tushar