PH49373: SAML: ADD REGEX AND LOGICAL OR SUPPORT TO FILTER PROPERTY

APAR status

• Closed as new function.

Error description

• In the SAML TAI, the filter property does not accept regular
  expressions.  Also, although the filter property has a logical
  AND operator, it does not have a logical OR operator.  These two
  missing functions often make it difficult for administrators to
  construct a filter to intercept requests.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  and SAML web SSO                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: Add support for regular expressions and *
  *                      logical OR to the SAML web SSO TAI      *
  *                      filter                                  *
  *                      property.                               *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The SAML web SSO TAI filter property does not support regular
  expressions or logical OR.
  

Problem conclusion

• The SAML web SSO TAI is updated to support both regular
  expressions and a logical OR in its filter property.
  
  * The operator for using a regular expression in the value for
  the filter property is ~=.  (tilde, equals)
    * If you want to make sure that a header does not exist, use
  the value \0.
    * If you want to make sure that a header exists, regardless of
  the value, use ^.*.
    * When you use the regex operator with remote-address, the
  runtime does not verify the input as it does with the other
  operators.
  
  * The logical OR operator is ||.
    * At runtime, the request is evaluated against the filter from
  left to right.
    * The expressions between each logical OR operators are
  evaluated individually.
    * You can have logical AND operators (;) within each logical
  OR section.
    * The runtime returns true if any expression between the
  logical OR operators is true.
  
  Example:
  request-url~=/ibm/console(?!/images/)(.*).*;remote-
  address~=129\..*;INTERNAL_HEADER~=^.*;EXTERNAL_HEADER~=\0||reque
  st-url%=acme/login||applicationNames==DefaultApplication
  
  =================
  Also, request-uri is added to the list of filter special input
  elements:
  
  request-uri - This filter compares against the part of the
  request URL from the protocol name up to the query string of the
  HTTP request. This value does not include the query string. For
  example, /app/folder/page.html
  
  
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.23 and 9.0.5.14. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels