WebSEAL Reverse Proxy Configuration
This section covers the WebSEAL configuration of a Verify Identity Access deployment. This includes configuring the reverse proxy policy server and user registry.
Administrators can also use this section to cover WebSEAL specific functionality such as HTTP transformation rules, client certificate mapping, federated user registries.
Example
webseal:
runtime:
policy_server: "ldap"
user_registry: "ldap"
ldap:
host: "openldap"
port: 636
dn: !secret default/isva_secrets:ldap_bind_dn
dn_password: !secret default/isva_secrets:ldap_bind_pw
key_file: "lmi_trust_store"
clean_ldap: True
domain: "Default"
admin_user: !secret default/isva_secrets:sec_user
admin_password: !secret default/isva_secrets:sec_pw
admin_cert_lifetime: 1460
ssl_compliance: "fips"
reverse_proxy:
- name: "default"
host: "isvaruntime"
http:
enabled: "no"
https:
enabled: "yes"
port: "9443"
domain: "Default"
ldap:
ssl: "yes"
port: 636
key_file: "lmi_trust_store"
aac_configuration:
hostname: "isvaruntime"
port: 9443
junction: "/mga"
user: !secret default/isva_secrets:runtime_user
password: !secret default/isva_secrets:runtime_pw
reuse_certs: True
reuse_acls: True
stanza_configuration:
- stanza: "acnt-mgt"
entry_id: "enable-local-response-redirect"
value: "yes"
operation: "update"
- stanza: "local-response-redirect"
entry_id: "local-response-redirect-uri"
value: "/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:password"
operation: "update"
pdadmin:
users:
- name: "testuser"
dn: !secret default/isva_secrets:test_dn
password: !secret default/isva_secrets:test_pw
WebSEAL Reverse Proxy Instances
Properties to configure a WebSEAL Reverse Proxy instance. A reverse proxy instance typically defines one or more junctions to protected application servers. This section can also be used to define configuration for the webseal.conf file as well as run the integration wizards for MMFA, AAC and Federation capabilities from the Federated Runtime Server. Configuration to connect to the user registry is read from the webseal.runtime entry.
Each item of this array must be:
Name of the reverse proxy instance.
The host name that is used by the Security Verify Identity Access policy server to contact the appliance.
Specifies whether to use a logical network interface for the instance. Only valid for appliance deployments.
Must be one of:
- "yes"
- "no"
The IP address for the logical interface. Only valid for appliance deployments where nwinterfaceyn is yes.
This is the listening port through which the instance communicates with the Security Verify Identity Access policy server.
Value must be greater or equal to 1 and lesser or equal to 65535
The Security Verify Identity Access domain.
LDAP policy server properties.
Enable SSL Verification of connections.
Must be one of:
- "yes"
- "no"
The SSL Database to use to verify connections. Only valid if ssl is yes.
The SSL Certificate to use to verify connections. Only valid of ssl is yes.
The network port to communicate with the LDAP server.
Value must be greater or equal to 1 and lesser or equal to 65535
HTTP traffic endpoint properties.
Enable traffic on this endpoint.
Network port that endpoint should listen on.
Value must be greater or equal to 1 and lesser or equal to 65535
Junctions to backend resource servers for this reverse proxy instance.
No Additional ItemsEach item of this array must be:
For each WebSEAL instance, administrators will typically define one or more standard or virtual junctions. Junctions are how an administrator defines the relationship and behavior between a WebSEAL server and an application server (for whom TCP traffic is being proxied by WebSEAL). Some advanced configuration options cannot be set in this entry and the stanza_configuration configuration must be used to set key/value entries in the reverse proxy config file.
Type of junction.
Must be one of:
- "tcp"
- "ssl"
- "tcpproxy"
- "sslproxy"
- "mutual"
Name of the location in the Reverse Proxy namespace where the root of the back-end application server namespace is mounted.
An optional description for this junction.
The DNS host name or IP address of the target back-end server.
TCP port of the back-end third-party server.
Defines how the Reverse Proxy server passes client identity information in HTTP basic authentication (BA) headers to the back-end server.
Must be one of:
- "filter"
- "ignore"
- "supply"
- "gso"
Enables IBM Security Federated Identity Manager single sign-on (SSO) for the junction.
Specifies whether the junction supports stateful applications.
Must be one of:
- "yes"
- "no"
Specifies whether a transparent path junction is created.
Must be one of:
- "yes"
- "no"
Specifies whether to enforce mutual authentication between a front-end Reverse Proxy server and a back-end Reverse Proxy server over SSL.
Specifies the encoding to use when the system generates HTTP headers for junctions.
Must be one of:
- "utf8_bin"
- "utf8_uri"
- "lcp_bin"
- "lcp_uri"
Specifies whether to use BA header information to authenticate to back-end server.
Must be one of:
- "yes"
- "no"
The key label for the client-side certificate that is used when the system authenticates to the junctioned Web server.
The name of the GSO resource or resource group.
Specifies whether to insert the IP address of the incoming request into an HTTP header for transmission to the junctioned Web server.
Must be one of:
- "yes"
- "no"
Location of the key file that is used to encrypt the LTPA cookie data.
Password for the key file that is used to encrypt LTPA cookie data.
Specifies whether to allow denied requests and failure reason information from authorization rules to be sent in the Boolean Rule header (AMAZNFAILURE) across the junction.
Must be one of:
- "yes"
- "no"
The name of the configuration file that is used for forms based single sign-on.
The Reverse Proxy user name to send BA header information to the back-end server.
The Reverse Proxy password to send BA header information to the back-end server.
Specifies the UUID that will be used to identify the junctioned Web server.
Virtual host name that is used for the junctioned Web server.
Specifies the distinguished name of the junctioned Web server.
Specifies the common name, or subject alternative name, of the junctioned Web server.
Specifies the local IP address that the Reverse Proxy uses when the system communicates with the target back-end server.
Provides the Reverse Proxy with the correct name of the query_contents program file and where to find the file.
Specifies whether the Reverse Proxy server treats URLs as case sensitive.
Must be one of:
- "yes"
- "no"
Specifies whether Windows style URLs are supported.
Must be one of:
- "yes"
- "no"
The TCP port of the proxy server.
Only applicable for virtual junctions. Specifies the replica set that sessions on the virtual junction are managed under.
Only applicable for virtual junctions. Causes a second virtual junction to share the protected object space with the initial virtual junction.
Specifies whether to overwrite an existing junction of the same name.
This option is valid only with junctions that were created with the type of ssl or sslproxy.
Must be one of:
- "yes"
- "no"
Supplies junction identification in a cookie to handle script-generated server-relative URLs.
Must be one of:
- "yes"
- "no"
Defines the hard limit percentage for consumption of worker threads.
Defines the soft limit percentage for consumption of worker threads.
HTTPS port of the back-end third-party server.
HTTP port of the back-end third-party server.
The TCP port of the proxy server.
Controls the insertion of Security Verify Identity Access specific client identity information in HTTP headers across the junction.
No Additional ItemsEach item of this array must be:
Must be one of:
- "iv-user"
- "iv-user-l"
- "iv-groups"
- "iv-creds"
- "all"
Properties for configuring this reverse proxy instance for use with advanced access control authentication and context based access service.
Junction to create.
Liberty runtime server properties.
Hostname or address of server.
Port server is listening on.
Value must be greater or equal to 1 and lesser or equal to 65535
Username to use for basic authentication.
Password to use for basic authentication.
Re-use existing Policy Server ACL's
Re-use existing certificates in the SSL database.
Properties for configuring this reverse proxy instance to deliver MMFA capabilities.
MMFA channel to configure.
Must be one of:
- "mobile"
- "browser"
- "both"
Re-use existing Policy Server ACL's
Re-use existing certificates in the SSL database.
Re-use existing Policy Server POP's
Properties for integrating with a running Federation runtime.
No Additional ItemsEach item of this array must be:
Federation runtime integration configuration wizard.
Name of the Federation.
Liberty runtime server properties.
Hostname or address of server.
Port server is listening on.
Value must be greater or equal to 1 and lesser or equal to 65535
Username to use for basic authentication.
Password to use for basic authentication.
Type of runtime. Valid values are 'local' for local runtimes (appliance) and 'remote' for external runtime (container).
Must be one of:
- "local"
- "remote"
Read the X.509 Certificate from the runtime server's https endpoint.
Must be one of:
- "on"
- "off"
Boolean option indicates if mutual TLS (client certificate) authentication should be performed with the runtime server.
Re-use existing Policy Server ACL's
Re-use existing certificates in the SSL database.
Properties for integrating this reverse proxy with OIDC API Protection Clients.
Name of the API Protection Junction.
Re-use existing Policy Server ACL's
Re-use existing certificates in the SSL database.
Should this reverse proxy be configured for API protection.
Should this reverse proxy be configured for Browser interaction.
Will the client registration endpoint require authentication.
Configures reverse proxy instance to be FAPI Compliant.
For each WebSEAL reverse proxy instance, administrators are able to define section/key/value entries to modify the webseal.conf file for that instance. Each stanza modification must also include an operation to either: add an entry, creating duplicate entries if the particular section/key combination already exists; update an entry if it already exists, or add it if it does not; and remove an entry if it exists.
Operation to perform on configuration file.
Must be one of:
- "add"
- "delete"
- "update"
Name of stanza to modify.
Optional entry name to modify.
Optional entry value to modify.
List of files to import into WebSEAL hosted pages. Directory structure should be relative to the predefined top-level directories.
No Additional ItemsEach item of this array must be:
reverse_proxy:
- name: default
host: ibmsec.verify.access
listening_port: 7234
domain: Default
http:
enabled: 'no'
https:
enabled: 'yes'
port: 443
junctions:
- junction_point: /app
description: Backend Application
junction_type: ssl
transparent_path_junction: true
server_hostname: 1.2.3.4
server_port: 443
remote_http_header:
- iv-user
- iv-groups
- iv-creds
aac_configuration:
hostname: localhost
port: 443
runtime:
user: runtime_user
password: runtime_password
junction: /mga
reuse_acls: true
reuse_certs: true
Policy Directory Admin
Administrators can use the pdadmin tool to modify the configured User Registry and Policy Server. This tool isused to: create Access Control Lists (ACL's); create Protected Object Policies (POP's); create users or groups; as well as attaching ACL's or POP's to a reverse proxy instance's object space. Configuration to connect to the user registry is read from the webseal.runtime entry.
pdadmin:
users:
- username: testuser
password: test_password
dn: cn=testuser,dc=iswga
- username: aacuser
password: aac_user_password
dn: cn=aacuser,dc=iswga
reverse_proxies:
- host: isva-wrp
instance: default-proxy
acls:
- name: isam_mobile_anyauth
junctions:
- /mga/sps/authsvc
- /mga/sps/apiauthsvc
- /intent/account-requests
- name: isam_mobile_rest_unauth
junctions:
- /mga/websock/mmfa-wss/
- /mga/sps/ac/info.js
- /mga/sps/ac/js/info.js
- /mga/sps/ac
- /.well-known
- /CertificateManagement/.well-known
- /mga/sps/mmfa/user/mgmt/qr_code
- /intent
pops:
- name: oauth-pop
junctions:
- /scim
List of users to add to the User Registry. These will be created as 'full' Verify Identity Access users.
No Additional ItemsEach item of this array must be:
User account configuration.
The name the user will authenticate as. By default this is the UID LDAP attribute.
The CN LDAP attribute for this user. If not set then username will be used.
The SN LDAP attribute for this user. If not set then username will be used.
The secret to authenticate as username.
The DN LDAP attribute for this user.
List of groups to add to the User Registry. These will be created as 'full' Verify Identity Access groups.
No Additional ItemsEach item of this array must be:
Group configuration.
The CN LDAP attribute for this group.
The DN LDAP attribute for this group.
Optional description of group.
Optional list of users to add to group. These users must already exist in the user registry.
No Additional ItemsEach item of this array must be:
List of ACL's to create in the Policy Server.
No Additional ItemsEach item of this array must be:
Access Control List configuration.
Name of the ACL.
Optional description of the ACL
List of extended attributes to add to ACL.
No Additional ItemsEach item of this array must be:
ACL extended attribute.
Name of the ACL attribute
Value of the ACL attribute.
List of users and the permissions they are permitted to perform.
No Additional ItemsEach item of this array must be:
User or Group entity with permissions.
User or Group entity to set permissions for.
Permission bit-string, eg. Tcmdbsvarxl
Must match regular expression:^[Tcmdbsvarxl]*$
List of groups and the permissions they are permitted to perform.
No Additional ItemsEach item of this array must be:
Permissions applied to users who do not match any of the defined user/group permissions.
Must match regular expression:^[Tcmdbsvarxl]*$
Permissions applied to unauthenticated users.
Must match regular expression:^[Tcmdbsvarxl]*$
List of POP's to create in the Policy Server.
No Additional ItemsEach item of this array must be:
Protected Object Policy configuration.
Name of the POP.
Optional description of the POP.
List of extended attribute to add to POP.
No Additional ItemsEach item of this array must be:
POP extended attribute.
Name of the POP attribute.
value of the POP attribute.
Sets the time of day range for the specified protected object policy.
Sets the audit level for the specified POP.
Must be one of:
- "none"
- "all"
- "permit"
- "deny"
- "admin"
- "error"
Sets the IP endpoint authentication settings in the specified POP.
No Additional ItemsEach item of this array must be:
IP-based authorization configuration.
Permissions for IP authentication not explicitly listed in the POP.
List of IP addresses to perform IP endpoint authentication.
No Additional ItemsEach item of this array must be:
Network IP authorization entry.
TCP/IP address to apply to this POP.
The corresponding netmask to apply to this POP.
Required step-up authentication level.
List of objects to attach attributes to.
No Additional ItemsEach item of this array must be:
WebSEAL object attribute configuration.
Hostname use by the reverse proxy in the Policy Server's namespace.
WebSEAL instance name if the Policy Server's namespace.
WebSEAL junction to modify.
List of attributes to add to junction object.
Must contain a minimum of 1 items
Each item of this array must be:
Attribute to attach to junction object.
Name of the attribute to attach to the junction object.
Value of the attribute to attach to the junction object.
List of ACL's and POP's to attach to a WebSEAL reverse proxy instance.
No Additional ItemsEach item of this array must be:
Reverse proxy ACL and POP attachments.
Hostname use by the reverse proxy in the Policy Server's namespace.
WebSEAL instance name if the Policy Server's namespace.
List of ACL's to attach to reverse proxy instance.
No Additional ItemsEach item of this array must be:
ACL attachment to reverse proxy junctions.
Name of the ACL to attach to resources.
List of junction paths which use the specified ACL.
Must contain a minimum of 1 items
Each item of this array must be:
List of POP's to attach to reverse proxy instance.
No Additional ItemsEach item of this array must be:
POP attachment to reverse proxy junctions.
Name of the POP to attach to resources.
List of junction paths which use the specified POP.
Client Certificate Mapping
Configuration for client certificate mapping using XSLT files to match X509 certificates from incoming connections to entities in the User Registry.
No Additional ItemsEach item of this array must be:
Path to XSLT file for certificate mapping.
client_cert_mapping:
- demo.mapping.xslt
- cert_to_uid.xlst
Junction Mapping
A Junction mapping table maps specific target resources to junction names. Junction mapping is an alternative to cookie-based solutions for filtering dynamically generated server-relative URLs. A rule is read from a file and uploaded to a Verify Identity Access deployment. The name of the file which contains the junction mapping config is the resulting rule name in Verify Identity Access.
No Additional ItemsEach item of this array must be:
Path to junction mapping properties file.
junction_mapping:
- demo.jct.map
- another.jct.map
URL Mapping
A URL mapping table is used to map WebSEAL access control lists (ACLs) and protected object policies (POPs) to dynamically generated URLs, such as URLs with query string parameters. URLs can be matched using a subset of UNIX shell pattern matching (including wildcards). A complete list of supported regex can be found here
No Additional ItemsEach item of this array must be:
Path to URL mapping configuration file.
url_mapping:
- dyn.url.conf
- url.map.conf
User Mapping
User mapping can be used to modify or enrich an authenticated user's credential data. This can be used to both switch the identity of a user or add attributes to a user's existing credential. User mapping rules are added to a Verify Identity Access deployment using XLST rules. Detailed information about user mapping XSLT configuration can be found here. The name of the XSLT file will be used as the name of the user mapping rule.
No Additional ItemsEach item of this array must be:
Path to XSLT user mapping file.
user_mapping:
- add_email.xslt
- federated_identity_to_basic_user.xslt
Forms Based Single Sign-On
The FSSO (forms single sing-on) module can be used by WebSEAL to authenticate a user to a junctioned application server. The module is capable of intercepting authentication requests from an application server, and then supplying the required identity information (retrieved from either the WebSEAl user registry or a HTTP service) to the application server to complete the authentication challenge. More detailed information about FSSO concepts can be found here. The name of the FSSO configuration file will be used as the name of the resulting FSSO configuration in Verify Identity Access.
No Additional ItemsEach item of this array must be:
Path to FSSO configuration file.
fsso:
- liberty_jsp_fsso.conf
- fsso.conf
HTTP Transformation Rules
HTTP transformation rules allow WebSEAL to inspect and rewrite request and response objects as they pass through the reverse proxy. HTTP transforms can be applied: when the request is received (by WebSEAL); after an authorization decision has been made; and when the response is received (by WebSEAL). Prior to Verify Access 10.0.4.0 only XSLT rules were supported, from 10.0.4.0 onwards, LUA scripts can also be used to write HTTP transforms. Detailed information about HTTP transformation concepts can be found here. The name of the HTTP transform file will be used as the name of the resulting HTTP transformation rule in Verify Identity Access.
http_transforms:
requests:
- inject_header.xslt
lua:
- eai.lua
List of files to be uploaded as XSLT request HTTP Transformation Rules.
No Additional ItemsEach item of this array must be:
List of files to be uploaded as XSLT response HTTP Transformation Rules.
No Additional ItemsEach item of this array must be:
List of files to be uploaded as LUA HTTP Transformation Rules.
No Additional ItemsEach item of this array must be:
Kerberos
The SPNEGO/Kerberos module can be used to enable SSO solutions to Microsoft (Active Directory) systems via Kerberos delegation. Kerberos is configured by setting properties by id and subsections. There are several top level id's which can be used to configure Kerberos Realms, Local Domain Realms, Certificate Authority paths and key files.
kerberos:
libdefault:
default_realm: test.com
realms:
- name: test.com
properties:
- kdc: test.com
domain_realms:
- name: demo.com
dns: test.com
keytabs:
- admin.keytab
- user.keytab
List of key: value properties to configure as defaults.
No Additional ItemsEach item of this array must be:
Each additional property must conform to the following schema
Type: stringList of Kerberos Realm's to configure.
No Additional ItemsEach item of this array must be:
Kerberos realm configuration.
Name of the Kerberos realm.
List of key / value properties to configure for realm.
No Additional ItemsEach item of this array must be:
Each additional property must conform to the following schema
Type: stringList of Kerberos Domain Realm's to configure.
No Additional ItemsEach item of this array must be:
Kerberos domain realm mapping.
Name of the Domain Realm.
DNS server for the Domain Realm.
List of files to import as Kerberos Keytab files.
No Additional ItemsEach item of this array must be:
Kerberos capaths configuration.
Additional Properties of any type are allowed.
Type: objectPassword Strength Rules
The password strength module can be used to enforce XLST defined password requirements for basic and full Verify Identity Access users. More detailed information about rule syntax can be found here. Rules are uploaded to a deployment from files, the name of the file is used as the resulting password strength rule in Verify Identity Access.
No Additional ItemsEach item of this array must be:
Path to XSLT file to be uploaded as password strength check.
password_strength:
- demo_rule.xlst
RSA SecurID Authentication
The RSA integration module can be used to allow users who are authenticating to WebSEAL's user registry to use a RSA OTP as a second factor. More information about configuring this mechanism and the correcsponding configuration to integrate with WebSEAL login can be found here.
rsa_config:
server_config: server.conf
optional_server_config: optional_server.conf
The server configuration file to upload.
The server configuration options file to upload.
Runtime Component
The WebSEAL runtime server is the Directory Server which contains the reverse proxy's user registry and policy server. This is typically a LDAP server external to the deployment, however an example LDAP server is made available to deployments for testing.
The Verify Identity Access specific LDAP schemas can be found in the System -> File Downloads section of an appliance/configuration container in the isva directory.
Any PKI required to verify this connection should be imported into a SSL database before the runtime component is configured.
runtime:
policy_server: remote
user_registry: remote
ldap:
host: openldap
port: 636
dn: cn=root,secAuthority=Default
dn_password: ldap-passwd
key_file: lmi_trust_store
clean_ldap: true
domain: Default
admin_password: secmaster-passwd
admin_cert_lifetime: 1460
ssl_compliance: FIPS 140-2
isam:
host: iviaconfig
port: 443
stanza_configuration:
- operation: update
resource: ldap.conf
stanza: bind-credentials
entry: bind-dn
value: cn=root,secAuthority=Default
- operation: delete
resource: ldap.conf
stanza: server:MyFederatedDirectory
runtime:
password: newEmbeddedLdapPassw0rd
admin_id: sec_master
admin_password: newEmbeddedLdapPassw0rd
The mode for the policy server.
Must be one of:
- "local"
- "remote"
Type of user registry to use.
Must be one of:
- "local"
- "ldap"
Remove any existing user data from registry. Only valid if user_registry is local.
The Security Verify Identity Access domain name.
The password for the sec_master user.
The lifetime in days for the SSL server certificate.
Value must be greater or equal to 1
Specifies whether SSL is compliant with any additional computer security standard.
Must be one of:
- "fips"
- "sp800-131-transition"
- "sp800-131-strict"
- "suite-b-128"
- "suite-b-192"
LDAP server properties.
Hostname or address for LDAP server.
Port LDAP server is listening on.
Value must be greater or equal to 1 and lesser or equal to 65535
Distinguished name to bind to LDAP server for admin operations.
Password to authenticate as dn.
SecAuthority suffix.
SSL Database to use to verify connections to LDAP server.
SSL Certificate label to verify connections to LDAP server.
Verify Identity Access policy server properties.
Hostname or address of Verify Identity Access policy server.
Port that Verify Identity Access policy server is listening on.
Value must be greater or equal to 1 and lesser or equal to 65535
Optional list of modifications to configuration files.
No Additional ItemsEach item of this array must be:
Configuration file stanza modification.
Operation to perform on configuration file.
Must be one of:
- "add"
- "delete"
- "update"
Filename to be modified.
Must be one of:
- "ldap.conf"
- "pd.conf"
- "instance.conf"
Name of stanza to modify.
Optional entry_id to modify.
Optional value to modify.
Optional property to attempt to force a reconfiguration of the runtime component if it is already configured. This is not possible if there are reverse proxy objects.
The password to update the embedded LDAP server's root user secret. If provided and the runtime component is in the Available state, this property can be used to modify the embedded LDAP root user cn=root,secAuthority=Default secret.
API Access Control
Configuration for API Access Control including authorization servers, resource servers, policies, and CORS settings. Properties to configure an API Authorization Server. An API authorization server typically defines one or more resource servers which have authentication requirements to permit access. This section can also be used to configure Cross-Origin Resource Sharing (CORS) policies. Configuration to connect to the user registry is read from the webseal.runtime entry.
api_access_control:
authorization_servers:
- name: api_server
hostname: localhost
auth_port: 9443
admin_port: 7138
domain: Default
addresses:
- 192.168.42.102
ssl: 'yes'
ssl_port: '636'
key_file: pdsrv.kdb
key_alias: webseal-cert
cors:
- name: cors_policy
allowed_origins:
- https://webseal.ibm.com
- https://webseal.ibm.com:9443
- http://static.webseal.ibm.com
- http://static.webseal.ibm.com:9080
allowed_credentials: true
exposed_headers:
- X-ISAM-VERSION
- X-ISAM-KEY
handle_preflight: true
allowed_methods:
- retry
- IBMPost
- Remove
allowed_headers:
- X-ISAM-MODE
- Content-type
max_age: 86400
List of API Resource servers to create.
No Additional ItemsEach item of this array must be:
API Resource Server configuration with junction and authentication settings. Resource servers are third party application servers / microservices that are being protected by the Authorization server.
Name of the WebSEAL Reverse Proxy instance this resource server is attached to.
The DNS host name or IP address of the target back-end server.
TCP port of the back-end third-party server. Default is 80 for TCP junctions and 443 for SSL junctions.
Value must be greater or equal to 1 and lesser or equal to 65535
Virtual host name that is used for the junctioned Web server.
Specifies the distinguished name of the junctioned Web server.
Specifies the common name, or subject alternative name, of the junctioned Web server.
An optional description for this junction.
Name of the location in the Reverse Proxy namespace where the root of the back-end application server namespace is mounted.
Type of junction.
Must be one of:
- "tcp"
- "ssl"
- "tcpproxy"
- "sslproxy"
- "mutual"
Specifies whether the junction supports stateful applications. By default, junctions are not stateful.
Must be one of:
- "yes"
- "no"
The Policy that is associated with this Resource Server.
The type of Policy.
Must be one of:
- "unauthenticated"
- "anyauthenticated"
- "none"
- "default"
- "custom"
The name of the custom policy if the type is custom.
The type of Oauth authentication.
Must be one of:
- "default"
- "oauth"
The transport type.
Must be one of:
- "none"
- "http"
- "https"
- "both"
The proxy, if any, used to reach the introspection endpoint.
The method for passing the authentication data to the introspection endpoint.
Must be one of:
- "client_secret_basic"
- "client_secret_post"
This is the introspection endpoint which will be called to handle the token introspection.
The client identifier which is used for authentication with the external OAuth introspection endpoint.
The client secret which is used for authentication with the external OAuth introspection endpoint.
The name of the HTTP header which contains the client identifier which is used to authenticate to the introspection endpoint. Only valid if client_id has not been set.
A hint about the type of the token submitted for introspection.
A formatted string which is used to construct the Verify Identity Access principal name from elements of the introspection response. Claims can be added to the identity string, surrounded by {}.
A boolean which is used to indicate whether the mapped identity should correspond to a known Verify Identity Access identity or not.
Must be one of:
- "true"
- "false"
A list of rules indicating which parts of the json response should be added to the credential.
No Additional ItemsEach item of this array must be:
Credential attribute configuration.
The position of this attribute in the ordered list of all attributes.
The action to perform for this attribute.
Must be one of:
- "put"
- "remove"
The name of the attribute.
A list of header names and values that should be added to the HTTP response.
No Additional ItemsEach item of this array must be:
HTTP response header configuration.
The name of the response header.
The value of the response header.
The name of the HTTP header that will contain the JWT.
The label of the personal certificate that will sign the JWT.
The list of claims to add to the JWT.
The type of claim to add to the JWT.
Must be one of:
- "text"
- "attr"
The value for the claim. If the type is text this will be the literal text that is added to the JWT. If the type is attr this will be the name of the credential attribute to add to the JWT.
The name of the claim that is added to the JWT. For attr type claims this is optional and if not specified the claim name will be set as the name of the credential attribute. If the type is attr and the value contains a wildcard this field is invalid and if specified will result in an error.
Defines the hard limit percentage for consumption of worker threads. Valid value is an integer from 0 to 100.
Must match regular expression:^([0-9]|[1-9][0-9]|100)$
Defines the soft limit percentage for consumption of worker threads. Valid value is an integer from 0 to 100.
Must match regular expression:^([0-9]|[1-9][0-9]|100)$
Defines how the Reverse Proxy server passes client identity information in HTTP basic authentication (BA) headers to the back-end server.
Must be one of:
- "filter"
- "ignore"
- "supply"
- "gso"
Enables IBM Security Federated Identity Manager single sign-on (SSO) for the junction.
Must be one of:
- "yes"
- "no"
Controls the insertion of Security Verify Identity Access specific client identity information in HTTP headers across the junction.
No Additional ItemsEach item of this array must be:
Must be one of:
- "iv-user"
- "iv-user-l"
- "iv-groups"
- "iv-creds"
- "all"
Specifies whether the junction supports the HTTP/2 protocol. By default, junctions do not support the HTTP/2 protocol.
Must be one of:
- "yes"
- "no"
Specifies whether the junction proxy support the HTTP/2 protocol. By default, junction proxies do not support the HTTP/2 protocol.
Must be one of:
- "yes"
- "no"
The server name indicator (SNI) to send to TLS junction servers. By default, no SNI is sent.
Specifies whether a transparent path junction is created.
Must be one of:
- "yes"
- "no"
Specifies whether to enforce mutual authentication between a front-end Reverse Proxy server and a back-end Reverse Proxy server over SSL.
Must be one of:
- "yes"
- "no"
Specifies the encoding to use when the system generates HTTP headers for junctions.
Must be one of:
- "utf8_bin"
- "utf8_uri"
- "lcp_bin"
- "lcp_uri"
Specifies whether to use BA header information to authenticate to back-end server.
Must be one of:
- "yes"
- "no"
The key label for the client-side certificate that is used when the system authenticates to the junctioned Web server.
The name of the GSO resource or resource group.
Specifies whether to insert the IP address of the incoming request into an HTTP header for transmission to the junctioned Web server.
Must be one of:
- "yes"
- "no"
Location of the key file that is used to encrypt the LTPA cookie data.
Specifies whether to allow denied requests and failure reason information from authorization rules to be sent in the Boolean Rule header (AMAZNFAILURE) across the junction.
Must be one of:
- "yes"
- "no"
The name of the configuration file that is used for forms based single sign-on.
The Reverse Proxy user name. Used to send BA header information to the back-end server.
The Reverse Proxy password. Used to send BA header information to the back-end server.
Specifies the local IP address that the Reverse Proxy uses when the system communicates with the target back-end server.
Provides the Reverse Proxy with the correct name of the querycontents program file and where to find the file. By default, the Windows file is called querycontents.exe and the UNIX file is called query_contents.sh.
Specifies whether the Reverse Proxy server treats URLs as case sensitive.
Must be one of:
- "yes"
- "no"
Specifies whether Windows style URLs are supported.
Must be one of:
- "yes"
- "no"
Password for the key file that is used to encrypt LTPA cookie data.
HTTPS port of the back-end third-party server. Applicable when the junction type is ssl.
Value must be greater or equal to 1 and lesser or equal to 65535
HTTP port of the back-end third-party server. Applicable when the junction type is tcp.
Value must be greater or equal to 1 and lesser or equal to 65535
The DNS host name or IP address of the proxy server. Applicable when the junction type is sslproxy.
The TCP port of the proxy server. Applicable when the junction type is tcpproxy.
Value must be greater or equal to 1 and lesser or equal to 65535
Only applicable for virtual junctions. Specifies the replica set that sessions on the virtual junction are managed under.
Only applicable for virtual junctions. Causes a second virtual junction to share the protected object space with the initial virtual junction.
This option is valid only with junctions that were created with the type of ssl or sslproxy. Indicates single sign-on from a front-end Reverse Proxy server to a back-end Reverse Proxy server.
Must be one of:
- "yes"
- "no"
Supplies junction identification in a cookie to handle script-generated server-relative URLs.
Must be one of:
- "yes"
- "no"
Specifies whether to overwrite an existing junction of the same name.
Must be one of:
- "yes"
- "no"
List of resources to add to resource server.
No Additional ItemsEach item of this array must be:
API resource configuration.
The HTTP action for this resource.
Must be one of:
- "GET"
- "POST"
- "PUT"
- "DELETE"
- "PATCH"
- "HEAD"
- "OPTIONS"
The URI path for this resource. This is a full server relative path including the junction point.
A description for this resource.
The name of the custom policy if the type is custom.
The type of Policy.
Must be one of:
- "unauthenticated"
- "anyauthenticated"
- "none"
- "default"
- "custom"
A list of header names and values that should be added to the HTTP response.
No Additional ItemsEach item of this array must be:
HTTP response header configuration.
Same definition as resource_servers_items_static_response_headers_itemsThe name of the rate limiting policy that has been set for this resource.
A list of aliases that all map to the path of this resource.
No Additional ItemsEach item of this array must be:
The value of the accept header that will trigger a documentation response.
The name and path of the documentation file to respond with, relative to the junction root.
The document root defines a static set of web files (HTML, JS, CSS, ect.) which can be served by the Authorization server.
No Additional ItemsEach item of this array must be:
List of API access control policies to create.
No Additional ItemsEach item of this array must be:
API access control policy configuration.
The name of the policy.
The groups referenced by this policy. User must be a member of at least one group for this policy to be authorized. The default is no groups if not specified.
No Additional ItemsEach item of this array must be:
The attribute matches referenced by this policy. Each attribute must be matched for this policy to be authorized. The default is no attributes if not specified.
No Additional ItemsEach item of this array must be:
List of Cross-Origin Resource Sharing policies to create.
No Additional ItemsEach item of this array must be:
CORS policy configuration. CORS policy can be used to configure the URI’s which are permitted to make cross-origin resource requests as well as the types of resources which are permitted to be shared.
The name of the CORS policy.
An array of origins which are allowed to make cross origin requests to this resource. Each origin must contain the schema and any non-default port information. A value of * indicates that any origin will be allowed.
No Additional ItemsEach item of this array must be:
Controls whether or not the Access-Control-Allow-Credentials header will be set. If not present, this value will default to false.
Controls the values populated in the Access-Control-Expose-Headers header.
No Additional ItemsEach item of this array must be:
Controls whether or not the Reverse Proxy will handle pre-flight requests. If not present, this value will default to false.
Controls the methods permitted in pre-flight requests and the subsequent Access-Control-Allow-Methods header. This option only relates to pre-flight requests handled by the Reverse Proxy and will be ignored if handle_preflight is set to false. Methods are case sensitive and simple methods (ie. GET, HEAD and POST) are always implicitly allowed.
No Additional ItemsEach item of this array must be:
Controls the headers permitted in pre-flight requests and the subsequent Access-Control-Allow-Headers header. This option only relates to pre-flight requests handled by the Reverse Proxy and will be ignored if handle_preflight is set to false.
No Additional ItemsEach item of this array must be:
Controls the Access-Control-Max-Age header added to pre-flight requests. If set to zero, the header will not be added to pre-flight responses. If set to -1, clients will be told not to cache at all. If not present, this value will default to 0.