I would suggest that you take a look at the 'client-ip-http-header' configuration entry within the '[aznapi-configuration]' stanza. This can be used to set the HTTP header which will be used as the client IP address in authorization decisions and auditing records.
In order to add the HTTP header to the request log you just need to modify the 'request-log-format' configuration entry within the '[logging]' stanza, using the '%{header}i' macro to include the HTTP header in the request log.
I hope that this helps.
Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor
 image002.png@01D85F83.85516C50">
|
Original Message:
Sent: 1/20/2025 2:21:00 AM
From: tuan dung duong
Subject: RE: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
yes Scott, we'll use it in policy decisions (in a POP), in the request log
------------------------------
tuan dung duong
------------------------------
Original Message:
Sent: Mon January 20, 2025 01:41 AM
From: Scott Exton
Subject: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
In what way? Are you talking about using it in policy decisions (in a POP), in the request log, something else?
Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor
Original Message:
Sent: 1/20/2025 1:27:00 AM
From: tuan dung duong
Subject: RE: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
thank Scott, how do I configure WebSEAL to use X-forward-For HTTP header from external WAF?
------------------------------
tuan dung duong
Original Message:
Sent: Sun January 19, 2025 10:44 PM
From: Scott Exton
Subject: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
If the WAF is setting the X-forward-For HTTP header correctly you can configure WebSEAL to use this instead of the network client IP address. How you do this will really come down to exactly what you are trying to achieve.
Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor
Original Message:
Sent: 1/19/2025 10:40:00 PM
From: tuan dung duong
Subject: RE: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
Thank JACK and Scott Exton, we try to configure with your options in Reverse Proxy, but it's not right option, we still got the error code: DPWIV1227W .
Then we try reconfigured in WAF with option encrypt in virtual service, it's worked nice, current we check logs request, message log in webseals, we don't find any information about real client' IP, we only find the WAF's IP which facing with reverse-proxy, in LB, WAF we also configured with x-forwarded-for option in header request. do you have any idea for this usecase?
------------------------------
tuan dung duong
Original Message:
Sent: Mon January 13, 2025 05:29 PM
From: JACK YARBOROUGH
Subject: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
If Imperva is sending HTTP requests to the Web Reverse Proxy you can set the following to allow the Reverse Proxy to accept that traffic:
[server]
...
web-http-port = 443
web-http-protocol = https
https://www.ibm.com/docs/en/sva/10.0.7?topic=stanza-web-http-port
https://www.ibm.com/docs/en/sva/10.0.7?topic=stanza-web-http-protocol
Try that out and confirm whether you get positive results.
------------------------------
JACK YARBOROUGH
Original Message:
Sent: Fri January 10, 2025 03:00 AM
From: tuan dung duong
Subject: How to intergration WebSEAL behind an external WAF (Imperva) without SSL
Hello experts from IBM, I am currently deploying the iam system using the webseal component version 10.0.7, the integration model is as follows:
end-user ---https---> LB (F5-Big IP) ---(ssl)---> WAF (Imperva)---(https)----> Webseal reverse proxy ---(https)---> Backend app
After configuring, when the user logs in to the url: https://iam.mydomain.com, an error is reported, unable to connect, checking the request log of the webseal reverse proxy, there is an error as follows: DPWIV1227W Webseal could not establish a secure connection with an incoming client. if client certificate authentication is not enabled check the webseal server certificate (function call: gsk_secure_soc_init; failed error: 0x19a GSK_ERROR_BAD_REQUEST_MESSAGE; 10.10.1.1 <ip of waf>) we installed cert on both LB & WAF same as a cert in webseal. We look forward to receiving everyone's help and advice on this usecase
------------------------------
tuan dung duong
------------------------------