This topic has 5 replies, 3 voices, and was last updated 4 years, 7 months ago by 
-
Posts
-
Hi All,
I am trying to capture the ‘401’ response of ‘PolicyEnforcementFilter’ filter in case of Unauthorized access.
Below is the config that I’ve put in my route file of openIG.
——————————
{
“handler”:{
“type”:”DispatchHandler”,
“config”:{
“bindings”:[
{
“condition”:”${request.cookies[‘iPlanetDirectoryPro’] == null}”,
“handler”:{
“type”:”StaticResponseHandler”,
“config”:{
“status”:302,
“reason”:”Found”,
“headers”:{
“Location”:[
“http://openam.example.com:8080/openam/XUI/#login/&goto=${urlEncode(contexts.router.originalUri)}”
]
},
“entity”:”Redirecting to OpenAM for authentication…”
}
}
},
{
“comment”:”This condition is optional, but included for clarity.”,
“condition”:”${request.cookies[‘iPlanetDirectoryPro’] != null}”,
“handler”:{
“type”:”Chain”,
“config”:{
“filters”:[
{
“name”:”AuthZPolicyEvaluationFilter”,
“type”:”PolicyEnforcementFilter”,
“config”:{
“openamUrl”:”http://openam.example.com:8080/openam/”,
“pepUsername”:”PolicyAdmin”,
“pepPassword”:”password”,
“ssoTokenSubject”:”${request.cookies[‘iPlanetDirectoryPro’][0].value}”,
“application”:”ApplicationName”
}
},
{
“name”:”UnauthorizedResponseSwitch”,
“type”:”SwitchFilter”,
“config”:{
“onResponse”:[
{
“condition”:”${response.status.code == 401}”,
“handler”:{
“name”:”FilterFailureHandler”,
“type”:”StaticResponseHandler”,
“config”:{
“status”:401,
“reason”:”Unauthorized Access”,
“entity”:”<html><h2>Unauthorized Access</h2></html>”
}
}
}
]
}
}
],
“handler”:{
“type”:”ClientHandler”,
“baseURI”:”http://openam.example.com:8080/”
}
}
}
}
]
}
},
“condition”:”${matches(request.uri.path, ‘^/sampleapp/header.jsp’)}”
}
——————————
But it is not working and I’m not getting the configured message in case of 401 failure.
From the filter doc, it looks like that the “response.status.code” should do but it ain’t working.
Anyone has done anything like this then please help out.Thanks,
JitendraHi Jitendra,
If the request is denied by the PolicyEnforcementFilter, OpenIG returns a 403 Forbidden.
See PolicyEnforcementFilter reference guide/Violette
Violette,
I tried with ${response.status.code == 403} condition as well but still not able to redirect to entity message.
Jitendra,
If you want to manage the cases where the policy denies the request, you have to put your ‘UnauthorizedResponseSwitch’ before the Policy Enforcement Filter.
You must be logged in to reply to this topic.
