Requirements for WebSEAL SSO integration

Question

KenshoTsuchihashi

Member since 2010

205 posts

PEGA

Posted: Mar 24, 2016

Last activity: Apr 7, 2016

Posted: 24 Mar 2016 8:42 EDT
Last activity: 7 Apr 2016 9:39 EDT

Closed

Requirements for WebSEAL SSO integration

Report

Hi,

We are about to build SSO integration with WebSEAL on Pega 7.2/WebLogic 12.1.3. I have provided the following two settings that Pega requires to WebSEAL team but they said these are not acceptable from their security policies.

[script-filtering]

script-filter=yes

rewrite-absolute-with-absolute=yes

[preserve-cookie-name]

#PRPC URL Obfuscation

name=JSESSIONID

#PRPC Visio/Word/Excel Compatibility

name=Pega-RULES

My question is, if these can't be accepted, does that mean we can't accomplish WebSEAL SSO integration or do we still have any alternatives?

They also have other regulations as follows:

- URL written in application must be in relative path.

- Do not use <BASE> tag.

- If application uses cookie, it has to be set in HTTP header. Cookie that has no value can't be used.

- If browser sends data to web server, use POST method as much as possible.

- Do not build application that uses Content-length: header.

- Use double quotation for URL for specifying tag.

- URL written in Java Script has to be in relative path.

- Do not use <> for variables.

etc

Thanks,

Kensho

To see attachments, please log in.

Data Integration

Like (0)
Share this page Facebook Twitter LinkedIn Email Copying... Copied!

Posted: 8 years ago

Posted: 26 Mar 2016 8:43 EDT

KevinZheng_GCS

PEGA

replied to KenshoTsuchihashi

Report

Chris Koyl, please take a look when you get a chance and reply back?

To see attachments, please log in.

Like (0)

Posted: 8 years ago

Posted: 28 Mar 2016 21:55 EDT

NareshReddy77843822

replied to KenshoTsuchihashi

Report

We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Background: WebSEAL operating in a traditional request/response paradigm

WebSEAL is a reverse proxy that uses URL rewriting to provide some of its core functionality. The role of a reverse proxy is to provide a centralized point to receive HTTP requests on behalf of a back-end Web server. When an HTTP request is received by the reverse proxy, it uses a junction (similar to a UNIX® mount) in order to determine to which back-end Web server to pass the request (see Figure 1-1). This generally requires that the URL be re-written in order to make sense to the Web server. The re-written request is then sent on to the back-end server. The back-end Web server accepts the request as a standard HTTP GET request and processes it accordingly.

Figure 1-1. Reverse proxy request processing

The second point where the reverse proxy acts as a mediator is by filtering the response from the back-end Web server to replace all URLs to include the junction details (see Figure 1-2). This ensures that all links in the returned HTML page point to valid URLs.

We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Background: WebSEAL operating in a traditional request/response paradigm

Figure 1-1. Reverse proxy request processing

Figure 1-2. Reverse proxy response processing

Before you can fully consider how WebSEAL will work with AJAX applications, it is essential to understand the fundamental rules WebSEAL uses to filter URL in the HTML content. These rules vary depending on the type of junction deployed in the environment. The following sections address each type of URL.

Filter rules for relative URLs

Relative URLs are always handled appropriately by the browser. Therefore, WebSEAL does not filter relative URLs.

Table 1. Example - Relative URLs

	Browser <-> IBM Tivoli WebSEAL	WebSEAL <-> Back-end Web server
Request	GET "example.html"	GET "example.html"
Response	<html> <head> <title>Example Page</title> </head> <body> <a href="../sample.html">Sample link</a> </body> </html>	<html> <head> <title>Example Page</title> </head> <body> <a href="../sample.html">Sample link</a> </body> </html>

Browser <-> IBM Tivoli WebSEAL

WebSEAL <-> Back-end Web server

Request

GET "example.html"

Response

<html> <head> <title>Example Page</title> </head> <body> <a href="../sample.html">Sample link</a> </body> </html>

<html> <head> <title>Example Page</title> </head> <body> <a href="../sample.html">Sample link</a> </body> </html>

Filter rules for server-relative URLs

WebSEAL must add the junction name to the path of server-relative URLs that refer to resources located on junctioned servers.

Table 2. Example: Server relative URLs

	Browser <-> IBM Tivoli WebSEAL	WebSEAL <-> Back-end Web server
Request	GET "/junction/html/example.html"	GET "/html/example.html"
Response	<html> <head> <title>Example Page</title> </head> <body> <a href="/junction/html/sample.html">Sample link</a> </body> </html>	<html> <head> <title>Example Page</title> </head> <body> <a href="/html/sample.html">Sample link</a> </body> </html>

Browser <-> IBM Tivoli WebSEAL

WebSEAL <-> Back-end Web server

Request

GET "/junction/html/example.html"

GET "/html/example.html"

Response

<html> <head> <title>Example Page</title> </head> <body> <a href="/junction/html/sample.html">Sample link</a> </body> </html>

<html> <head> <title>Example Page</title> </head> <body> <a href="/html/sample.html">Sample link</a> </body> </html>

Filter rules for absolute URLs

WebSEAL must add the junction name to the path of the absolute URLs that refer to resources located on junctioned servers. By default, WebSEAL changes the absolute URL into a server-relative URL. The rewrite-absolute-with-absolute parameter determines if the absolute URL is used. This parameter is located in the WebSEAL configuration file, which is by default located at WEBSEAL_HOME/etc/webseald-instance.conf

Table 3. Example: Absolute URLs

	Browser <-> IBM Tivoli WebSEAL	WebSEAL <-> Back-end Web server
Request	GET "http://www.ibm.com/junction/html/example.html"	GET "http://www.backend.com/html/example.html"
Response	<html> <head> <title>Example page</title> </head> <body> <a href="/junction/html/sample.html">Sample link</a> </body> </html>	<html> <head> <title>Example Page</title> </head> <body> <a href="http://www.backend.com/html/sample.html"> Sample link</a> </body> </html>
Response (rewrite-absolute- with-absolute=yes)	<html> <head> <title>Example page</title> </head> <body> <a href="http://www.ibm.com/junction/html/sample.html"> Sample link</a> </body> </html>	<html> <head> <title>Example page</title> </head> <body> <a href="http://www.backend.com/html/sample.html"> Sample link</a> </body> </html>

Browser <-> IBM Tivoli WebSEAL

WebSEAL <-> Back-end Web server

Request

GET "http://www.ibm.com/junction/html/example.html"

GET "http://www.backend.com/html/example.html"

Response

<html> <head> <title>Example page</title> </head> <body> <a href="/junction/html/sample.html">Sample link</a> </body> </html>

<html> <head> <title>Example Page</title> </head> <body> <a href="http://www.backend.com/html/sample.html"> Sample link</a> </body> </html>

Response (rewrite-absolute- with-absolute=yes)

<html> <head> <title>Example page</title> </head> <body> <a href="http://www.ibm.com/junction/html/sample.html"> Sample link</a> </body> </html>

<html> <head> <title>Example page</title> </head> <body> <a href="http://www.backend.com/html/sample.html"> Sample link</a> </body> </html>

Reference: https://developer.ibm.com/product-doclinks/

Show Less

To see attachments, please log in.

Like (0)

Posted: 8 years ago

Posted: 29 Mar 2016 8:02 EDT

Chunzhi_Hong

PEGA

replied to NareshReddy77843822

Report

Hi Naresh,

>We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Could you give some examples which support your statement?

Chunzhi

To see attachments, please log in.

Like (0)

Posted: 8 years ago

Posted: 29 Mar 2016 22:56 EDT

NareshReddy77843822

replied to Chunzhi_Hong

Report

Please use Fiddler to capture traffic during log-in and other scenarios.

Show Less

To see attachments, please log in.

Like (0)

Posted: 8 years ago

Posted: 30 Mar 2016 0:50 EDT

Chunzhi_Hong

PEGA

replied to NareshReddy77843822

Report

Hi Naresh,

I don't get your point.

Could you be more specific which PRPC feature may not work with a server-relative URL and the reason why it won't work?

Chunzhi

To see attachments, please log in.

Like (0)

Posted: 8 years ago

Updated: 8 years ago

Posted: 7 Apr 2016 8:02 EDT
Updated: 7 Apr 2016 9:39 EDT

BalaGhali

PEGA

replied to Chunzhi_Hong

Report

I don't think prpc would function effectively if we have relative url's in place - mainly static content that relies on AG hash and other features might fail.

I think there is a request from customer an year ago asking prpc to support relative url's if i am not wrong idea of supporting relative url's in prpc is dropped sighting side effects that it would introduce , instead Pathbreakers team did work on EPIC-4338 to support prpc work behind reverse proxy with configuring xff headers , but i think this feature work has been done on ML10.

Having said that i may not fully answer your queries , please revert if you need anything ...

I will try answering few of your questions -

- If application uses cookie, it has to be set in HTTP header. Cookie that has no value can't be used. - since customer is on ssl or tls ? all cookies by default can be secured with prconfig

http/setsecurecookie

- URL written in Java Script has to be in relative path. - Static content might not work , any other side effects

- Do not use <> for variables. - what do you mean by variables ? query parameters in url ?

To see attachments, please log in.

Like (0)

Question

Requirements for WebSEAL SSO integration

We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Background: WebSEAL operating in a traditional request/response paradigm

Figure 1-1. Reverse proxy request processing

We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Background: WebSEAL operating in a traditional request/response paradigm

Figure 1-1. Reverse proxy request processing

Figure 1-2. Reverse proxy response processing

Filter rules for relative URLs

Table 1. Example - Relative URLs

Filter rules for server-relative URLs

Table 2. Example: Server relative URLs

Filter rules for absolute URLs

Table 3. Example: Absolute URLs

>We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Need help or want to help others?

Experience the benefits of Support Center when you log in.

Question

Requirements for WebSEAL SSO integration

We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Background: WebSEAL operating in a traditional request/response paradigm

Figure 1-1. Reverse proxy request processing

We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Background: WebSEAL operating in a traditional request/response paradigm

Figure 1-1. Reverse proxy request processing

Figure 1-2. Reverse proxy response processing

Filter rules for relative URLs

Table 1. Example - Relative URLs

Filter rules for server-relative URLs

Table 2. Example: Server relative URLs

Filter rules for absolute URLs

Table 3. Example: Absolute URLs

>We would need above Security Policy in Pega as we deal with many absolute URL's in request & response.

Related content:

Need help or want to help others?

Experience the benefits of Support Center when you log in.

We'd prefer it if you saw us at our best.