IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Set Response Header in Mapping Rule

    Posted 06/24/21 04:18 PM

    Hi,

    So we have a situation where RTSS is returning the EAI Redirect URL with a header that is different than what is set in the webseal's eai-redir-url-header attribute.  Don't ask me why this is :(

    Unfortunately, this is making some custom redirects in the mapping rule impossible at the moment.  Is there a way to set a response header in a mapping rule?  The only way I know to do this is to use the attribute() and this turns it into an extended attribute.  The idea is I set the response header to what the webseal is expecting in the configuration.

    Thanks,
    Troy


    ------------------------------
    Troy Burkle
    ------------------------------


  • 2.  RE: Set Response Header in Mapping Rule

    Posted 06/25/21 07:32 AM
    Hi Troy,

    I don't think you're talking about the RTSS.  The RTSS is the part of AAC that evaluates context-based policies.  It doesn't interact with EAI at all.
    I think you're probably talking about Advanced Authentication and you need the EAI response generated when a policy completes with "success" to use a different header name to return the redirect URL?

    It's not currently possible to directly influence the headers returned on successful completion of an authentication policy; this is managed by the "Point of Contact" code (which is shared by both AAC and Federation functions).  There are some workarounds but perhaps you can get what you need simply by modifying the Point of Contact configuration.

    Point of Contact is a menu item under both AAC and Federation menus (they both take you to the same place - this configuration is global).
    In the Point of Contact screen you'll find 3 built-in "profiles".  One of these will be selected.  If you view the properties of the selected profile and look under "Sign-in" you'll see the headers that are being used to return information - including the redirect URL.

    You can't change the built in profiles but you can use the "create like" button to create a copy which you can edit.  Maybe you can just create a copy of your active profile, change the redirect header to whatever you need it to be to match WebSEAL, and then select this as the active profile.

    Does this give you what you need?  If not, can you explain the complication that means this won't work for you?

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------