In the past Verify Support has received cases asking for various ways to force the running of the info.js script which is needed for AAC device registration. The Knowledge Center section Configuring the attribute collection service notes to add the URL of info.js to the <head> block in the HTML landing page of your application. This may not always be possible. Adding the URL to the login.html page of WebSEAL can work but requires modifying default ACLs and it only works for Forms login. We had yet another case a few weeks ago in which a customer asked for a different way to do this so I came up with an Infomap solution that is transparent to the user and can be used in various ways. This example shows the use case of accessing a resource as unauthenticated and then after authentication being sent to a landing page. Under the covers the info.js script is run and the attributes collected. Go to Support’s GitHub at InfoJSLoader to download InfoJSLoader.js and InfoJSLoader.html. Be sure to update the URLs in the html file to point your website.
Update the WebSEAL Config File
[server]
maximum-followed-redirects = 4
follow-redirects-for = GET /mga/sps/authsvc*
follow-redirects-for = GET /jct/*
[azn-decision-info]
urn:ibm:security:custom:infojsloaded = cookie:AMWEBJCT!%2Fmga!ac.uuid
[user-attribute-definitions]
urn:ibm:security:custom:infojsloaded.datatype = string
urn:ibm:security:custom:infojsloaded.category = Environment
[acnt-mgt]
login-redirect-page = /dashboard/
[enable-redirects]
redirect = forms-auth
Set this if using SPNEGO or BA.
[session]
update-session-cookie-in-login-request = true
We will use the infojsloaded attribute to check if info.js has been run or not. You may ask why not just use the already defined ac.uuid attribute? The reason is that attribute is a built-in and is not defined to be used in AAC Policy.
Create the Corresponding Attribute in AAC
There is no need to provide an Issuer due to the WebSEAL config setting.
Create the Template Page for the Infomap
Navigate to https://appliance_hostname/mga/template_files, create the directory, and upload the html file.
Create the Mapping Rule for the Infomap
Navigate to https://appliance_hostname/mga/mapping_rules and import InfoJSLoader.js. Name it InfoJSLoader.
Create a New Authentication Mechanism
Navigate to https://appliance_hostname/mga/authentication and select the “Mechanisms” tab.
Select the “+” and create a new “Info Map Authentication”
Move to the Properties tab and set:
Create a New Authentication Policy
Navigate to https://appliance_hostname/mga/authentication and select the “Policies” tab. The only Workflow Step is the InfoJSLoader mechanism.
Create an Access Control Policy
Navigate to https://appliance_hostname/mga/policy and select the “Policies Tab”. Create a new Policy.
Attach the Policy to a Resource. Here Lab comes from the Web Reverse Proxy config file setting "server-name = Lab" setting and /dashboard is a standard junction to backend application. We want to run info.js before crossing the junction.
Let’s Test Out the Policy
I want to access https://www.ibmsecuritysupport.org/dashboard/ unauthenticated. Here we show the browser has no cookies set for https://www.ibmsecuritysupport.org/dashboard/:
Let’s access https://www.ibmsecuritysupport/dashboard/. I get prompted to authenticate:
Enter my credentials and I get taken to my site’s dashboard. Note the AAC info.js related cookies.
This is a simple use case and when there is more complex policy on specific resources that use a riskScore you will need to add the check for infojsloaded to make sure info.js has been run.
As with any security policy, thoroughly test and make sure this Infomap will work for your environment.
#ISAM