IBM Security Verify

 View Only
Expand all | Collapse all

max-concurrent-web-session policy not enforced

  • 1.  max-concurrent-web-session policy not enforced

    Posted Tue March 19, 2019 09:24 AM

    We have the distribution session deployed and enabled on reverse proxy nodes

    dsess-enabled = yes

    enforce-max-sessions-policy = yes

    prompt-for-displacement = yes

    dsess-cluster-name = dsess

    [dsess-cluster] server = 9,http://127.0.0.1:2035/DSess/services/DSess

    but reverse proxy not enforces this policy

    policy get max-concurrent-web-sessions "displace"

    we have 2 reverse proxies configured for the same domain. One is federated to TFIM with seperate authorization server while the other one is not federated. This policy is not being enforced for TFIM federated Reverse proxy where as this policy is enforced and working good for other reverse proxy which does the authorization by itself.



    ------------------------------
    Shanmugarajan M
    ------------------------------


  • 2.  RE: max-concurrent-web-session policy not enforced

    Posted Wed March 20, 2019 06:26 AM
    It sounds like you have the federation component configured to send back a PAC (or credential) to WebSEAL.  In this instance WebSEAL does not create the credential itself but instead uses the credential which has been supplied.  This means that the credential is probably missing the attribute which tells WebSEAL how many concurrent sessions are allowed.  The easiest fix is to change the federation configuration so that it returns the itemised credential information to WebSEAL so that WebSEAL can generate the credential itself.
     



    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Access Manager
    IBM Master Inventor
    Phone: 61-7-5552-4008
    E-mail: scotte@au1.ibm.com
    L11 & L7 Seabank
    Southport, QLD 4215
    Australia




    Original Message


  • 3.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 02:37 AM
    Hi Scott,

    I am actually quite interested in the name of this (and by extension all) parameter that should be added to the PAC in case you do want to send back the PAC to WebSEAL.

    Do you know where I can find documentation on that? I found some info in the WebSEAL administration guide, but was not able to find back the parameter for this specific setting.

    Thx in advance

    ------------------------------
    Kristof Goossens
    ------------------------------

    Original Message


  • 4.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 04:49 AM
    Kristof,

    I don't believe that we document the name of the attribute, but for your reference it is called: tagvalue_max_concurrent_web_sessions

    Thanks,

    Scott.

    ------------------------------
    Scott Exton
    IBM
    Gold Coast
    ------------------------------

    Original Message


  • 5.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 06:46 AM
    Can you please tell me , how to add that attribute ?(tagvalue_max_concurrent_web_sessions)

    ------------------------------
    Shanmugarajan M
    ------------------------------

    Original Message


  • 6.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 07:00 AM
    Hi All,

    Based on this thread I created a blog post for this group which provides details on how credentials are built when using WebSEAL native authentication vs AAC with individual headers vs AAC with PAC.

    https://community.ibm.com/community/user/security/blogs/jon-harry/2019/03/21/sam-credential-attributes

    Cheers... Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 7.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 07:04 AM
    Edited by Jon Harry Thu March 21, 2019 07:05 AM
    Shanmugarajan,

    Can you confirm which PoC Profile you have configured for AAC/Federation configuration?

    If you are (as we suspect) using the "Access Manager Credential" profile, is there a particular reason for this?  If you change to use the "Non-Access Manager User" profile then you should get the tagvalue_max_concurrent_web_sessions attribute (and other useful attributes) without any other customization.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 8.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 08:32 AM

    Hi Jon

    The profile name I can see in the RPX node's PoC is  "Access Manager Username and extended attributes". 

    In the authz server i have added the below stanza so that we would get the max sessions value to webseal but that didnt help

    [credential-policy-attributes]
    AZN_POLICY_MAX_CONCURRENT_WEB_SESSIONS = tagvalue_max_concurrent_web_sessions

    I have tried to modify the junction object to set the below attribute to HTTP-Tag-value , that also didnt help
    object modify /WebSEAL/member/sps set attribute HTTP-Tag-Value AZN_POLICY_MAX_CONCURRENT_WEB_SESSIONS = tagvalue_max_concurrent_web_sessions




    ------------------------------
    Shanmugarajan M
    ------------------------------

    Original Message


  • 9.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 09:19 AM
    And we are experiencing the following lines repeatedly in RPX log


    87 2019-03-19-18:44:41.806+01:00I----- 0x38B9A426 webseald ERROR wns session WSRemoteCache.cpp 2924 0x7fca32df8700 -- DPWNS1062E An attempt to update a session failed with error code 0x38a0a13e.
    88 2019-03-19-18:46:05.270+01:00I----- 0x38B9A426 webseald ERROR wns session WSRemoteCache.cpp 2924 0x7fca4183e700 -- DPWNS1062E An attempt to update a session failed with error code 0x38a0a13e.
    89 2019-03-19-18:50:09.392+01:00I----- 0x38AD50C9 webseald ERROR wiv azn WSCredsCacheEntry.cpp 994 0x7fca406fa700 -- DPWIV0201E The azn-api function 'azn_creds_get_attr_value_string(tagvalue_max_concurrent_web_sessions)' returned 0x150000
    90 2019-03-19-18:53:02.482+01:00I----- 0x38AD50C9 webseald ERROR wiv azn WSCredsCacheEntry.cpp 994 0x7fca407fe700 -- DPWIV0201E The azn-api function 'azn_creds_get_attr_value_string(tagvalue_max_concurrent_web_sessions)' returned 0x150000
    91 2019-03-19-19:21:49.044+01:00I----- 0x38B9A427 webseald ERROR wns session WSRemoteCache.cpp 3201 0x7fca54a4e700 -- DPWNS1063E An attempt to delete a session failed with error code 0x38a0a13e.
    92 2019-03-19-19:21:49.044+01:00I----- 0x38B9A41B webseald ERROR wns session WSRemoteCache.cpp 2228 0x7fca54a4e700 -- DPWNS1051E Addition or update of a session cache entry failed.

    ------------------------------
    Shanmugarajan M
    ------------------------------

    Original Message


  • 10.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 09:49 AM
    This is my stanza:

    ###############################
# CREDENTIAL POLICY ATTRIBUTES
###############################
[credential-policy-attributes]
# This stanza controls which TAM policy values are stored in credentials
# during authentication.  In order for this stanza to take effect you must
# also enable the TAM credential policy entitlements service in the aznapi
# stanzas above this one.
#
# Format is:
#    <policy-name> = <credential-attribute-name>
#
# Supported policies are listed here.  Uncomment the policies you wish
# to add to credentials.

#AZN_POLICY_MAX_FAILED_LOGIN = tagvalue_max_failed_login
#AZN_POLICY_DISABLE_TIME = tagvalue_disable_time
#AZN_POLICY_ACCOUNT_EXPIRY_DATE = tagvalue_account_expiry_date
#AZN_POLICY_MAX_PASSWORD_AGE = tagvalue_max_password_age
#AZN_POLICY_MAX_PASSWORD_REPEATED_CHARS = tagvalue_max_password_repeated_chars
#AZN_POLICY_MIN_PASSWORD_ALPHAS = tagvalue_min_password_alphas
#AZN_POLICY_MIN_PASSWORD_NON_ALPHAS = tagvalue_min_password_non_alphas
#AZN_POLICY_PASSWORD_SPACES_ALLOWED = tagvalue_password_spaces_allowed
#AZN_POLICY_MIN_PASSWORD_LENGTH = tagvalue_min_password_length
#AZN_POLICY_TOD = tagvalue_tod
#AZN_POLICY_MAX_CONCURRENT_WEB_SESSIONS = tagvalue_max_concurrent_web_sessions
AZN_POLICY_MAX_CONCURRENT_WEB_SESSIONS = tagvalue_max_concurrent_web_sessions​

    The referenced policy entitlements service is automatically enabled on the appliance and isn't shown in the configuration file editor.

    You said you added this stanza - are you sure it didn't already exist elsewhere in the file?


    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 11.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 10:31 AM
    In the RPX conf file, the stanza you have given is available . at the same time I have added this to ivacld.conf (authorization server;s conf).


    is there any way to add this (MAX_CONCURRENT_WEB_SESSIONS) as an attribute to the TFIM junction object like below , will it work?

    object modify /WebSEAL/dmz-member/ugm set attribute HTTP-Tag-Value credattrs_sn=sn

    ------------------------------
    Shanmugarajan M
    ------------------------------

    Original Message


  • 12.  RE: max-concurrent-web-session policy not enforced

    Posted Thu March 21, 2019 11:15 AM
    Hello,

    Now that you have mentioned TFIM again, I'm wondering if your issue is because you're not getting the concurrent web session attribute for users that are coming via TFIM.  Is that correct?  If so, I think I've been failing to understand your situation properly until now.

    TFIM always returns a PAC to WebSEAL and so it must include the tagvalue_max_concurrent_web_sessions attribute in this PAC.

    If TFIM is using the ISAM Authorization Server to build its credential *and* you have the credential attribute configuration set up to read the max_concurrent_web_sessions policy, this might work.  I think by default though, TFIM builds the PAC itself without going to the Authorization Server.

    The simplest answer might be to modify the mapping rule in TFIM so that it directly adds the tagvalue_max_concurrent_web_sessions attribute to the credential.  That should fix your issue.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 13.  RE: max-concurrent-web-session policy not enforced

    Posted Fri March 22, 2019 03:24 AM
    Yes correct, our issue is we 're not getting the concurrent web session attribute for users that are coming via TFIM.

    It seems TFIM is using the ISAM Authorization Server and builds its registry attributes but not credential policy attributes.

    Do we have to add anything like the given below stanza for tagvalue_max_concurrent_web_sessions attribute on the authorization server config file?(if so nothing added like that)

    [TAM_CRED_ATTRS_SVC:Person]
    tagvalue_credattrs_sn = sn

    is there any way where we can verify that   tagvalue_max_concurrent_web_sessions attribute is returned in the PAC from TFIM?(i.e.,trace of which component will have this info)

    Change of mapping rule has been decided as the last option. if nothing  works


    ------------------------------
    Shanmugarajan M
    ------------------------------

    Original Message


  • 14.  RE: max-concurrent-web-session policy not enforced

    Posted Fri March 22, 2019 08:22 AM
    Shanmugarajan,

    Today I started up an ISAM appliance, created an Authorization Server, and took a look directly at the raw authorization server configuration file for the additional configuration entries that are required to support the credential entitlement service that adds policy information to user credential.  They are not present.

    I attempted to add these entries using the configuration editor but it would not allow this.  This leads me to believe that, unfortunately, the authorization server in the ISAM appliance cannot support the ability to add policy attributes to the user credential.

    I believe your only options is to use the federation mapping rule to add the tagvalue-max-concurrent-web-sessions attribute.

    Sorry I couldn't get this working for you.

    Jon.


    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message