Access and Authentication
ISAM Advanced Access Control Infomap to run info.js
March 14, 2019 | Written by: nlloyd@us.ibm.com
Categorized: Access and Authentication
Share this post:
In the past Level II Support has received Cases asking for various ways to force the running of the info.js script which is needed for AAC device registration. The Knowledge Center section Configuring the attribute collection service notes to add the URL of info.js to the <head> block in the HTML landing page of your application. This may not always be possible. Adding the URL to the login.html page of WebSEAL can work but requires modifying default ACLs and it only works for Forms login. We had yet another Case a few weeks ago in which a customer asked for a different way to do this so I came up with an Infomap solution that is transparent to the user and can be used in various ways. This example shows the use case of accessing a resource as unauthenticated and then after authentication being sent to a landing page. Under the covers the info.js script is run and the attributes collected. Go to Support’s GitHub at InfoJSLoader to download InfoJSLoader.js and InfoJSLoader.html. Be sure to update the URLs in the html file to point your website.
Update the WebSEAL config file
[server]
maximum-followed-redirects = 4
follow-redirects-for = GET /mga/sps/authsvc*
follow-redirects-for = GET /jct/*
[azn-decision-info]
urn:ibm:security:custom:infojsloaded = cookie:AMWEBJCT!%2Fmga!ac.uuid
[user-attribute-definitions]
urn:ibm:security:custom:infojsloaded.datatype = string
urn:ibm:security:custom:infojsloaded.category = Environment
[acnt-mgt]
login-redirect-page = /jct/
[enable-redirects]
redirect = forms-auth
Set this if using SPNEGO or BA.
[session]
update-session-cookie-in-login-request = true
We will use the infojsloaded attribute to check if info.js has been run or not. You may ask why not just use the already defined ac.uuid attribute? The reason is that attribute is a built-in and is not defined to be used in AAC Policy.
Create the corresponding attribute in AAC
There is no need to provide an Issuer due to the WebSEAL config setting.
Create the template page for the Infomap
Navigate to https://appliance_hostname/mga/template_files, create the directory, and upload the html file.
Create the mapping rule for the Infomap
Navigate to https://appliance_hostname/mga/mapping_rules and import InfoJSLoader.js. Name it InfoJSLoader.
Create a new Authentication Mechanism
Navigate to https://appliance_hostname/mga/authentication and select the “Mechanisms” tab.
Select the “+” and create a new “Info Map Authentication”
Move to the Properties tab and set:
Create a new Authentication Policy
Navigate to https://appliance_hostname/mga/authentication and select the “Policies” tab. The only Workflow Step is the InfoJSLoader mechanism.
Create an Access Control Policy
Navigate to https://appliance_hostname/mga/policy and select the “Policies Tab”. Create a new Policy.
Attach the Policy to a Resource:
Let’s test out the Policy
I want to access https://isamotp.level2.org/jct/AAC_DRIVER.html unauthenticated. Here we show the browser has no cookies set for https://isamotp.level2.org:
Let’s access https://isamotp.level2.org/jct/AAC_DRIVER.html. I get prompted to authenticate:
Enter my credentials and I get taken to my site’s dashboard. Note the AAC info.js related cookies.
This is a simple use case and when there is more complex policy on specific resources that use a riskScore you will need to add the check for infojsloaded to make sure info.js has been run.
As with any security policy, thoroughly test and make sure this Infomap will work for your environment.
Modernizing your B2C Portal Security – A thoughtful approach
As we have described the situation that many of our customers are in today, and our proposal for a better future state, we come to realize that for many, this transition is a journey, and a single big bang transition is not practical for many. This blog entry will outline an approach to start such […]
Modernizing your B2C Portal Security – Desired End State
Proposition: As we have seen in part one of this series, managing customer identities for a portal can be a challenge and distraction for the business. In this part of the series we will outline how a modernized solution for a portal security can simplify operations and free your team up to focus on the […]
Modernizing your B2C Portal Security – Introduction and Challenges
Introduction: Business to Consumer (B2C) is an incredibly common kind of identity and access management implementation. This implementation allows consumers to self-register and self-manage their digital identities for a given retailer or service provider. The provider does this so that they can streamline subsequent interactions with consumers and to provide a seamless user experience while […]