Dear All,

We are looking for a solution for TOTP (step-up)  authentication in case of multiple  domains. I try to example a bit more.

Currently we do have a solution which is working partially. Our internet domain is xyz.de  We have standard, VHJ, OIDC, SAML connections. For any domain like *.de  TOTP is working. If we are using different domain like *.com TOTP is not working. During our troubleshooting the "domain coockie' is not set for non "de" domains.

Is there any way to configure webseals to accept all domains?



------------------------------
Regards,
Janos Laszlo Horvath
------------------------------

Hello Janos,

If your TOTP is working for the "base" domain of your Reverse Proxy but not for the Virtual Host Junctions, it may be because you need to set this configuration parameter:

match-vhj-first = no

This parameter tells the Reverse Proxy to match on standard junctions first which means that you can still access /mga/.... even if you're connecting to the Virtual Host associated with a Virtual Host Junction.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hello Jon,

Thank you for your answer. This configuration setting is already set to "no" /match-vhj-first / .   As we recognized TOTP is working  only for  VHJs where domain is matching.

Example:

VHJ abc.fgh.de  --> not working  (fgh <> jkl)
VHJ *.com / *.edu etc --> not working 

VHJ abc.jkl.de   --> working  (jkl.de = jkl.de)

In relevant RP:    
domain = jkl.de
web-host-name = servername.jkl.de
match-vhj-first = no

------------------------------
Janos Laszlo Horvath
------------------------------

Original Message:
Sent: Thu June 11, 2020 06:41 AM
From: Jon Harry
Subject: TOTP solution for multiple

Hello Janos,

If your TOTP is working for the "base" domain of your Reverse Proxy but not for the Virtual Host Junctions, it may be because you need to set this configuration parameter:

match-vhj-first = no

This parameter tells the Reverse Proxy to match on standard junctions first which means that you can still access /mga/.... even if you're connecting to the Virtual Host associated with a Virtual Host Junction.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Janos,

You mention configuration:
domain = jkl.de

Is this the domain setting in the [session-cookie-domains] stanza?
If any entry is set in this stanza, only hosts within that domain will be able to set a session cookie.  To allow things to work properly you must either remove all entries, or make sure that you have entries to cover all the domains you will use.

Unless you specifically want sessions to be shared across hosts in the same domain, I would recommend removing all domain entries.  It might be a good idea anyway for troubleshooting purposes.

As an aside: If you want to allow single sign-on between hosts, and you have hosts in different domains, you should probably be looking at a pattern that includes a central Identity Provider with federation (SAML or OpenID Connect) used to assert identity to other domains.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: Fri June 12, 2020 09:09 AM
From: Janos Laszlo Horvath
Subject: TOTP solution for multiple

Hello Jon,

Thank you for your answer. This configuration setting is already set to "no" /match-vhj-first / .   As we recognized TOTP is working  only for  VHJs where domain is matching.

Example:

VHJ abc.fgh.de  --> not working  (fgh <> jkl)
VHJ *.com / *.edu etc --> not working 

VHJ abc.jkl.de   --> working  (jkl.de = jkl.de)

In relevant RP:    
domain = jkl.de
web-host-name = servername.jkl.de
match-vhj-first = no

------------------------------
Janos Laszlo Horvath
------------------------------


Original Message:
Sent: Thu June 11, 2020 06:41 AM
From: Jon Harry
Subject: TOTP solution for multiple

Hello Janos,

If your TOTP is working for the "base" domain of your Reverse Proxy but not for the Virtual Host Junctions, it may be because you need to set this configuration parameter:

match-vhj-first = no

This parameter tells the Reverse Proxy to match on standard junctions first which means that you can still access /mga/.... even if you're connecting to the Virtual Host associated with a Virtual Host Junction.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Hi Jon,

Sorry for delayed answer.  Yes I'm talking about [session-cookie-domains] stanza. I have tried to remove current settings (so not configure  "domain=" and no "web-host-name").

Unfotrunately no luck.   Now we keep the best configuration where we have 1 domain set and web-host-name is also set for same domain (like domain=jkl.de and web-host-name = websealhost.jkl.de).

Using this:

VHJ with same domain ending "vhjname.jkl.de"   we have redirected back to  ISAM login page
SAML connection: we have got invalid SAML message failure message. Here is interesting if I call again the same SAML SP login URL  (same browser)  I have got right page  (so authentication is successfully at the background, but redirection is not working for some reason)

One more note, we have separated servers for AAC and RP. It shouldn't be a problem.



------------------------------
Janos Laszlo Horvath
------------------------------

Original Message:
Sent: Fri June 12, 2020 09:57 AM
From: Jon Harry
Subject: TOTP solution for multiple

Hi Janos,

You mention configuration:
domain = jkl.de

Is this the domain setting in the [session-cookie-domains] stanza?
If any entry is set in this stanza, only hosts within that domain will be able to set a session cookie.  To allow things to work properly you must either remove all entries, or make sure that you have entries to cover all the domains you will use.

Unless you specifically want sessions to be shared across hosts in the same domain, I would recommend removing all domain entries.  It might be a good idea anyway for troubleshooting purposes.

As an aside: If you want to allow single sign-on between hosts, and you have hosts in different domains, you should probably be looking at a pattern that includes a central Identity Provider with federation (SAML or OpenID Connect) used to assert identity to other domains.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------


Original Message:
Sent: Fri June 12, 2020 09:09 AM
From: Janos Laszlo Horvath
Subject: TOTP solution for multiple

Hello Jon,

Thank you for your answer. This configuration setting is already set to "no" /match-vhj-first / .   As we recognized TOTP is working  only for  VHJs where domain is matching.

Example:

VHJ abc.fgh.de  --> not working  (fgh <> jkl)
VHJ *.com / *.edu etc --> not working 

VHJ abc.jkl.de   --> working  (jkl.de = jkl.de)

In relevant RP:    
domain = jkl.de
web-host-name = servername.jkl.de
match-vhj-first = no

------------------------------
Janos Laszlo Horvath


Original Message:
Sent: Thu June 11, 2020 06:41 AM
From: Jon Harry
Subject: TOTP solution for multiple

Hello Janos,

If your TOTP is working for the "base" domain of your Reverse Proxy but not for the Virtual Host Junctions, it may be because you need to set this configuration parameter:

match-vhj-first = no

This parameter tells the Reverse Proxy to match on standard junctions first which means that you can still access /mga/.... even if you're connecting to the Virtual Host associated with a Virtual Host Junction.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM