- ForgeRock Forum and Blog

chris-fry replied to the topic Common Logging Config for all routes in the forum Identity Gateway 4 years, 8 months ago

Hi Guillaume,

So, just use a named audit service configuration in the heap and refer to it in each route? I have done this, but I was hoping to have it set by default to avoid configuration duplication.

– Chris

chris-fry replied to the topic OpenIG – Apache rewrite 302 in the forum Identity Gateway 4 years, 8 months ago

I might be missing something, but if you just want a rewrite (without path transformation), this should do it:
{ "baseURI": "http://emanuals.example.com", "condition": "${request.uri.host eq 'www.example.com'}", "handler": "ClientHandler" }

If you want a redirect (302), this is probably more what you want. It redirects requests to…[Read more]

chris-fry started the topic Common Logging Config for all routes in the forum Identity Gateway 4 years, 8 months ago

Hi,

Is there a way to create an an AuditService configuration that applies to all routes without specifying it in each individual route?

I’ve been able to create a named audit service in the heap and include that in each route, but I’d rather just have it on for all routes without needing to be consciously included each time.

Here’s the…[Read more]

chris-fry replied to the topic Authorization Policy Design in the forum Access Management 4 years, 8 months ago

Hi Scott, thanks for your reply.

We’ve reached an approach that I think will work for our use case.

We will use multiple policy sets (and avoid using the default set), grouping policies by technology type (because URL format is highly affected by this) and if required owning business unit (because in some cases a popular technology in an…[Read more]

chris-fry replied to the topic OpenIG unable to load all pages and login from the proxied url in the forum Identity Gateway 4 years, 8 months ago

A few questions:
* Have you confirmed you can route to the ec2 machine from the IG machine directly (perhaps using curl or similar)?
* Do you have conditions on your route handlers? If so, what are they and what order are the routes configured?
* Can you share your route(s)?

It sounds like your first route might be picking up the requests…[Read more]

chris-fry replied to the topic Evaluate policy for multiple policy-sets in the forum Identity Gateway 4 years, 8 months ago

The Policy Enforcement Point (PEP) filter can only accept a single “application” (Policy Set), but you should be able to chain multiple PEP filters.

e.g.
{ "handler": { "type": "DispatchHandler", "config": { "bindings": == null}", "handler": { "type": "StaticResponseHandler", "config": {…[Read more]

chris-fry started the topic Authorization Policy Design in the forum Access Management 4 years, 8 months ago

Hi all – a bit of a design question;

I’ve just started playing around with Authorization Policies in Access Manager.

It looks like there are many ways to approach these (akin to directory design) e.g. using a single policy set, or perhaps one set per application, one per information asset class (might be better for auditing) etc. Then there’s…[Read more]

chris-fry replied to the topic Add Basic Authentication against Access Manager to an Application in the forum Identity Gateway 4 years, 8 months ago

Ok – got it working. I created a scriptable filter that checks for, decodes and validates a basic authentication header against Access Manager, then passes the resulting token to the next filter/handler in the chain. Then I just added this in front of an SSO, Policy Enforcement Point filter chain (as per this guide). I wanted to avoid non-standard…[Read more]

chris-fry replied to the topic Add Basic Authentication against Access Manager to an Application in the forum Identity Gateway 4 years, 9 months ago

Thanks for your response, Joachim.

It’s getting close – I’ve used an approach similar to what you’ve described, decoding the Basic Auth header and using an LDAP provider for authentication.

I can’t figure out how to call OpenAM from the scriptable filter however. I’ve done this from a number of other clients (Python, Postman etc.), but can’t…[Read more]

chris-fry started the topic Add Basic Authentication against Access Manager to an Application in the forum Identity Gateway 4 years, 9 months ago

I have a web application with no built in security isolated in a secured network and would like to expose this to a wider network via IG, using OpenAM for AuthN/AuthZ.

My consumer can only support Basic Authentication at this stage.

Two questions:
– Can I configure a Basic Authentication filter that uses OpenAM (or even DJ/LDAPS) as the…[Read more]