IBM Security Verify

I interpreted the question differently from Scott. If I understand it correctly, you want WebSEAL to process the BA header itself when some URLs are visited, and completely ignore it and pass it down to the backend junction for other URLs.

If my intepretation is correct you can do this. What you have to do is:

1. Leave the current config in place:

[ba]ba-auth=https

2. Make sure you allow unauthenticated access on the junction where you want to send the ba header. In my case I did this:

pdadmin> acl attach /WebSEAL/localhost-testba/jsonsnoop isam_mobile_rest_unauth

3. When creating the junction, use the `-b ignore` flag, or use the junction editor in the LMI and on the Identity tab, change the `HTTP Basic Authentication Header` option to `Ignore`.

In my case this processed the BA header for resources not on that junction, and passed the BA header across the /jsonsnoop junction.

[ba]ba-auth = https

[server:/myJunctionThatNeedsToIgnoreBA]auth-challenge-type = none

I interpreted the question differently from Scott. If I understand it correctly, you want WebSEAL to process the BA header itself when some URLs are visited, and completely ignore it and pass it down to the backend junction for other URLs.

If my intepretation is correct you can do this. What you have to do is:

1. Leave the current config in place:

[ba]ba-auth=https

2. Make sure you allow unauthenticated access on the junction where you want to send the ba header. In my case I did this:

pdadmin> acl attach /WebSEAL/localhost-testba/jsonsnoop isam_mobile_rest_unauth

3. When creating the junction, use the `-b ignore` flag, or use the junction editor in the LMI and on the Identity tab, change the `HTTP Basic Authentication Header` option to `Ignore`.

In my case this processed the BA header for resources not on that junction, and passed the BA header across the /jsonsnoop junction.

[ba]ba-auth = https

[server:/myJunctionThatNeedsToIgnoreBA]auth-challenge-type = none

All I can suggest is try:

pdadmin sec_master> acl show isam_mobile_rest_unauth    ACL Name: isam_mobile_rest_unauth    Description:     Entries:         Any-other Tmdrxl        User sec_master TcmdbsvaBRrxl        Group iv-admin TcmdbsvaBRrxl        Group webseal-servers Tgmdbsrxl        Unauthenticated Tmdrxl

I don't believe it's your version of ISAM/ISVA - this is long-standing behaviour.

I interpreted the question differently from Scott. If I understand it correctly, you want WebSEAL to process the BA header itself when some URLs are visited, and completely ignore it and pass it down to the backend junction for other URLs.

If my intepretation is correct you can do this. What you have to do is:

1. Leave the current config in place:

[ba]ba-auth=https

2. Make sure you allow unauthenticated access on the junction where you want to send the ba header. In my case I did this:

pdadmin> acl attach /WebSEAL/localhost-testba/jsonsnoop isam_mobile_rest_unauth

3. When creating the junction, use the `-b ignore` flag, or use the junction editor in the LMI and on the Identity tab, change the `HTTP Basic Authentication Header` option to `Ignore`.

In my case this processed the BA header for resources not on that junction, and passed the BA header across the /jsonsnoop junction.

[ba]ba-auth = https

[server:/myJunctionThatNeedsToIgnoreBA]auth-challenge-type = none

All I can suggest is try:

pdadmin sec_master> acl show isam_mobile_rest_unauth    ACL Name: isam_mobile_rest_unauth    Description:     Entries:         Any-other Tmdrxl        User sec_master TcmdbsvaBRrxl        Group iv-admin TcmdbsvaBRrxl        Group webseal-servers Tgmdbsrxl        Unauthenticated Tmdrxl

I don't believe it's your version of ISAM/ISVA - this is long-standing behaviour.

I interpreted the question differently from Scott. If I understand it correctly, you want WebSEAL to process the BA header itself when some URLs are visited, and completely ignore it and pass it down to the backend junction for other URLs.

If my intepretation is correct you can do this. What you have to do is:

1. Leave the current config in place:

[ba]ba-auth=https

2. Make sure you allow unauthenticated access on the junction where you want to send the ba header. In my case I did this:

pdadmin> acl attach /WebSEAL/localhost-testba/jsonsnoop isam_mobile_rest_unauth

3. When creating the junction, use the `-b ignore` flag, or use the junction editor in the LMI and on the Identity tab, change the `HTTP Basic Authentication Header` option to `Ignore`.

In my case this processed the BA header for resources not on that junction, and passed the BA header across the /jsonsnoop junction.

------------------------------
Shane Weeden
IBM

Original Message:
Sent: Thu December 01, 2022 07:31 AM
From: André Leruitte
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

Hi Scott,

Thank you for your reply.


BA is indeed enabled at the RP level : 

[ba]ba-auth = https

[server:/myJunctionThatNeedsToIgnoreBA]auth-challenge-type = none

HI Andre,

Please let me know if you were able to achieve it, as i am also facing same issue.

------------------------------
Tara Sharma

Original Message:
Sent: Fri December 02, 2022 09:56 AM
From: André Leruitte
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

Hi Shane,

Thanks for the acl detail.

This is not working for me, webseal still handles the Authorization header.


I will try creating a new reverse proxy for testing the behavior in isolation of the rest of the config. There may be other settings (such as forms-auth = https) that could be modifying the behavior.

I will keep you updated.

------------------------------
André Leruitte

Original Message:
Sent: Fri December 02, 2022 05:09 AM
From: Shane Weeden
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

All I can suggest is try:

pdadmin sec_master> acl show isam_mobile_rest_unauth    ACL Name: isam_mobile_rest_unauth    Description:     Entries:         Any-other Tmdrxl        User sec_master TcmdbsvaBRrxl        Group iv-admin TcmdbsvaBRrxl        Group webseal-servers Tgmdbsrxl        Unauthenticated Tmdrxl

I don't believe it's your version of ISAM/ISVA - this is long-standing behaviour.

I interpreted the question differently from Scott. If I understand it correctly, you want WebSEAL to process the BA header itself when some URLs are visited, and completely ignore it and pass it down to the backend junction for other URLs.

If my intepretation is correct you can do this. What you have to do is:

1. Leave the current config in place:

[ba]ba-auth=https

2. Make sure you allow unauthenticated access on the junction where you want to send the ba header. In my case I did this:

pdadmin> acl attach /WebSEAL/localhost-testba/jsonsnoop isam_mobile_rest_unauth

3. When creating the junction, use the `-b ignore` flag, or use the junction editor in the LMI and on the Identity tab, change the `HTTP Basic Authentication Header` option to `Ignore`.

In my case this processed the BA header for resources not on that junction, and passed the BA header across the /jsonsnoop junction.

------------------------------
Shane Weeden
IBM

Original Message:
Sent: Thu December 01, 2022 07:31 AM
From: André Leruitte
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

Hi Scott,

Thank you for your reply.


BA is indeed enabled at the RP level : 

[ba]ba-auth = https

[server:/myJunctionThatNeedsToIgnoreBA]auth-challenge-type = none

Hi Tara,

Unfortunately I was unable to find any workaround. As Scott explained very clearly, it seems not possible to mix basic-auth for some junctions and completely ignoring the Authorization header for other junctions for the same reverse proxy.

I did test on another reverse proxy where the basic-auth is not enabled, and it works exactly as expected for a junction where Ignore is configured for the BA Header. If you have absolutely no other option, maybe this workaround of creating another proxy could be an alternative solution.

Regards

HI Andre,

Please let me know if you were able to achieve it, as i am also facing same issue.

------------------------------
Tara Sharma

Original Message:
Sent: Fri December 02, 2022 09:56 AM
From: André Leruitte
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

Hi Shane,

Thanks for the acl detail.

This is not working for me, webseal still handles the Authorization header.


I will try creating a new reverse proxy for testing the behavior in isolation of the rest of the config. There may be other settings (such as forms-auth = https) that could be modifying the behavior.

I will keep you updated.

------------------------------
André Leruitte

Original Message:
Sent: Fri December 02, 2022 05:09 AM
From: Shane Weeden
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

All I can suggest is try:

pdadmin sec_master> acl show isam_mobile_rest_unauth    ACL Name: isam_mobile_rest_unauth    Description:     Entries:         Any-other Tmdrxl        User sec_master TcmdbsvaBRrxl        Group iv-admin TcmdbsvaBRrxl        Group webseal-servers Tgmdbsrxl        Unauthenticated Tmdrxl

I don't believe it's your version of ISAM/ISVA - this is long-standing behaviour.

I interpreted the question differently from Scott. If I understand it correctly, you want WebSEAL to process the BA header itself when some URLs are visited, and completely ignore it and pass it down to the backend junction for other URLs.

If my intepretation is correct you can do this. What you have to do is:

1. Leave the current config in place:

[ba]ba-auth=https

2. Make sure you allow unauthenticated access on the junction where you want to send the ba header. In my case I did this:

pdadmin> acl attach /WebSEAL/localhost-testba/jsonsnoop isam_mobile_rest_unauth

3. When creating the junction, use the `-b ignore` flag, or use the junction editor in the LMI and on the Identity tab, change the `HTTP Basic Authentication Header` option to `Ignore`.

In my case this processed the BA header for resources not on that junction, and passed the BA header across the /jsonsnoop junction.

------------------------------
Shane Weeden
IBM

Original Message:
Sent: Thu December 01, 2022 07:31 AM
From: André Leruitte
Subject: How to configure webseal to ignore "Authorization" header for a specific junction?

Hi Scott,

Thank you for your reply.


BA is indeed enabled at the RP level : 

[ba]ba-auth = https

[server:/myJunctionThatNeedsToIgnoreBA]auth-challenge-type = none