Access and Authentication
ISAM Advanced Access Control Infomap to run info.js
March 14, 2019 | Written by: nlloyd@us.ibm.com
Categorized: Access and Authentication
Share this post:
In the past Level II Support has received Cases asking for various ways to force the running of the info.js script which is needed for AAC device registration. The Knowledge Center section Configuring the attribute collection service notes to add the URL of info.js to the <head> block in the HTML landing page of your application. This may not always be possible. Adding the URL to the login.html page of WebSEAL can work but requires modifying default ACLs and it only works for Forms login. We had yet another Case a few weeks ago in which a customer asked for a different way to do this so I came up with an Infomap solution that is transparent to the user and can be used in various ways. This example shows the use case of accessing a resource as unauthenticated and then after authentication being sent to a landing page. Under the covers the info.js script is run and the attributes collected. Go to Support’s GitHub at InfoJSLoader to download InfoJSLoader.js and InfoJSLoader.html. Be sure to update the URLs in the html file to point your website.
Update the WebSEAL config file
[server]
maximum-followed-redirects = 4
follow-redirects-for = GET /mga/sps/authsvc*
follow-redirects-for = GET /jct/*
[azn-decision-info]
urn:ibm:security:custom:infojsloaded = cookie:AMWEBJCT!%2Fmga!ac.uuid
[user-attribute-definitions]
urn:ibm:security:custom:infojsloaded.datatype = string
urn:ibm:security:custom:infojsloaded.category = Environment
[acnt-mgt]
login-redirect-page = /jct/
[enable-redirects]
redirect = forms-auth
We will use the infojsloaded attribute to check if info.js has been run or not. You may ask why not just use the already defined ac.uuid attribute? The reason is that attribute is a built-in and is not defined to be used in AAC Policy.
Create the corresponding attribute in AAC
There is no need to provide an Issuer due to the WebSEAL config setting.
Create the template page for the Infomap
Navigate to https://appliance_hostname/mga/template_files, create the directory, and upload the html file.
Create the mapping rule for the Infomap
Navigate to https://appliance_hostname/mga/mapping_rules and import InfoJSLoader.js. Name it InfoJSLoader.
Create a new Authentication Mechanism
Navigate to https://appliance_hostname/mga/authentication and select the “Mechanisms” tab.
Select the “+” and create a new “Info Map Authentication”
Move to the Properties tab and set:
Create a new Authentication Policy
Navigate to https://appliance_hostname/mga/authentication and select the “Policies” tab. The only Workflow Step is the InfoJSLoader mechanism.
Create an Access Control Policy
Navigate to https://appliance_hostname/mga/policy and select the “Policies Tab”. Create a new Policy.
Attach the Policy to a Resource:
Let’s test out the Policy
I want to access https://isamotp.level2.org/jct/AAC_DRIVER.html unauthenticated. Here we show the browser has no cookies set for https://isamotp.level2.org:
Let’s access https://isamotp.level2.org/jct/AAC_DRIVER.html. I get prompted to authenticate:
Enter my credentials and I get taken to my site’s dashboard. Note the AAC info.js related cookies.
This is a simple use case and when there is more complex policy on specific resources that use a riskScore you will need to add the check for infojsloaded to make sure info.js has been run.
As with any security policy, thoroughly test and make sure this Infomap will work for your environment.
Calling all IBM Tivoli Federated Identity Manager Customers
An open letter to our IBM Tivoli Federated Identity Manager customers, As part of the IBM Security Access Manager development teams ongoing focus to support our customer base we are hoping to gain a better understanding as to how we can assist our IBM Tivoli Federated Identity Manager customers to migrate to our IBM […]
Hybrid ISAM Environments
IBM Security Access Manager introduced support for Docker a few years ago with the publishing of the IBM Security Access Docker image. The interest in Docker has recently increased and questions are now being asked around how to run both the appliance and Docker in the same environment. This is especially useful for customers who have […]
IBM Security Access Manager Helm Charts
IBM has published a Helm chart which can be used to easily deploy an IBM Security Access Manager environment within a Kubernetes infrastructure. What is Helm? In simple terms Helm is a management layer which sits in front of Kubernetes and can be used to manage the various elements of a Kubernetes environment (e.g. deployments […]