Authorization decision data
To correctly construct the RST, the EAS requires various information from the request itself. WebSEAL must be configured to provide this information to the EAS.
The majority of the required data is provided on every authorization request by specifying these HTTP request elements in the [azn-decision-info] stanza. See Authorization decision information from HTTP requests.
Note: In certain situations, the POST data is also required. For efficiency,
the EAS plug-in does not provide the POST data on every authorization
decision request. Instead, the plug-in uses the existing dynamic access
decision information within WebSEAL to optionally request the POST
data when required. WebSEAL recognizes the request for POST data based
on the resource-manager-provided-adi configuration
entry in the [aznapi-configuration] stanza.
It is vital that this configuration stanza is correct so that the data is passed to the EAS. The following configuration entries are required in order for the EAS to function correctly:
[azn-decision-info]
#
# The following information will be provided to the authorization
# framework for every authorization request. This information
# is required by the OAuth EAS when validating an OAuth token.
#
HTTP_REQUEST_METHOD = method
HTTP_REQUEST_SCHEME = scheme
HTTP_REQUEST_URI = uri
HTTP_HOST_HDR = header:host
HTTP_CONTENT_TYPE_HDR = header:content-type
HTTP_TRANSFER_ENCODING_HDR = header:transfer-encoding
HTTP_AZN_HDR = header:authorization
[aznapi-configuration]
resource-manager-provided-adi = AMWS_pb_