WebSEAL Caching

Webseal provides a capability to cache static web contents in order to increase the response time of a transaction. Two things which drive the caching behavior are

1. Response headers -> determines if the content is eligible for the caching. To put in simple words based on few response headers webseal decide whether a image or a javascipt or a CSS file will be stored in Webseal cache memory or not.
2. Request headers -> determines if requested resource will be served from the webseal cache or request will be passed to the backend server.

As far as Webseal is concern it is required to understand the caching at

1. Webseal level
2. Browser level

WebSEAL cache the contents based on the following conditions

1. If request has a attribute query, it will not cache the response of such request
2. If junction has –c, -C or -b supply attribute, it will not cache the contents of such responses
3. WebSEAL does not cache the contents of the user if user is authenticated using SPNEGO or BA

Details on enabling caching in WebSEAL can be found at the IBM site.
Most critical part to understand caching is to understand how browser handles the caching. Most of the browsers store the static contents like images, javascripts, CSS files and html pages in browser’s local cache. When a request is made to the same resource again browser tries to use the content in the local cache and it save lot of round trips to the WebSEAL and backend servers.
The reuse of contents from the browser’s local cache depends on “Expiration” parameter of the content. If content stored in browser’s cache has “expiration” value set to future date browser will reuse the same content and will not send any request to WebSEAL or backend server. If “expiration” date is not set browser will send request to backend sever to get the latest contents.
Another parameter which impact browser caching is “Last-modified” timestamp. If Last-Modified time stamp is set for the content in browser’s cache and “expiration” date is not set, it will send a request to the WebSEAL/Backend server with “if-modified-since” header. This header will carry last-modified timestamp. Upon receiving a request from browser with if-modified-since header, webseal will compare the timestamp of if-modified-since header with the contents stored in the WebSEAL cache. If modified date of the content in WebSEAL cache is same as that of if-modified-since it will send a “304 HTTP Response” to the browser. This response will not contain any content other than HTTP headers. It tells browser that contents in browser cache is good to use.
If browser is sending the request to WebSEAL and requested static contents are not present in the browser’s cache or “last-modified” date is not present, it will not send any “if-modified-since” header to the WebSEAL. If WebSEAL find the contents in WebSEAL’s cache it will return HTTP response 200 and send the contents to the browser without contacting backend server.

Details of the transaction can be seen in the WebSEAL by enabling pdweb.debug trace. It shows complete flow of every transaction
Browser -> PD
PD -> Backend
Backend -> PD
PD -> Browser

Common problems with ID&AM projects

Following list mentions most commonly seen issues with IAM related projects –
1)Foggy technology road map
Envision is key of good technology road map to provide a smooth ride to IT services. IT architects of a company need to realize relevance of ID&AM services into overall enterprise architecture. ID&AM is not just about buying an identity and access management tool to provision accounts to few systems. It is important to define one authentication and authorization layer and one Identity management services layers and more important is to publish a direction in where most of the application use services provided by ID&AM components. I have seen company buying costly IDM suit but not leveraging full potential of it.
2) More focus towards technology
An Identity playing a specific role in an organization has access to specific resources and is authorize to do defined business operations. ID&AM is more about defining a process based on the business requirement which controls the link between Identity, Access and authorization. On contrary ID&AM team is more focused towards technology than business and process aspect of the IAM. It might result in failure of the project as it does not meet business requirements.
3) Incorrect tool selection
It is very important to select a right identity and access management solution which suits both functional and technology needs of an enterprise. On functional part ID&AM solution controls life cycle of business entities (like provisioning of accounts/access, grant/restrict access based on profile, de-provisioning etc.), access governance based on business policies, roles and entitlements. On technology part, in order to manage identity and access of all the entities in an organization, ID&AM components need to integrate with desperate end system. So evaluation of a ID&AM solution becomes very important to make it can meet business needs and integrates with most of proprietary systems in an organization.
4) Identity Islands
In a traditional enterprise design every application maintain a separate identity store for the users of the application. It result into creation of duplicate identity information and increase the access point for the availability of user sensitive information. By introducing the ID&AM architecture it should target to reduce the identity stores across enterprise and provide centralized access and policy management platform. It usually require very strong selling to provide a strategic solution to remove authentication layer from legacy applications and introducing common access management layer.
5) Leadership support
For success of any ID&AM project it is very important to buy confidence of higher leadership in the organization.

Step-up authentication in Tivoli Access Manager

Very basic usage of setp-up authentication is in a scenario where there is a requirement of elevated access to particular resource protected by WebSEAL. For example there are two applications behind WebSEAL App1 and App2. Forms authentication is setup in the WebSEAL and every user in TAM registry logs in to App1 using forms authentication. But a user can access App2 only if he authenticates using token. How it happens in TAM is like this:

1. user accesses http://webseal/app1


2. webseal sends 401 response to user and ask for form based authentication


3. user provides userid and password


4. Webseal validates user


5. Webseal creates user credentials


6. Webseal check whether user is authorize to access app1


7. request is send to app1 and response from app1 is sent to user

Now at this point webseal has user credentials in cache. When user tries to access any other resource on webseal on same session webseal will not ask user to authenticate again as user credentials already exists.
In webseal it is possible to define levels of authentication. It means you can say token authentication is at higher level than forms based authentication or vice versa. Coming back to the flow

8. User tries to access http://webseal/app2


9. WebSEAL check that user is authenticated with forms based and required authentication level for app2 is token authentication. Also level defined for token authentication is higher than forms based authentication.


10. WebSEAL forces user for token authentication and upon successful authentication user is granted access.

Now assuming user had authenticated with token based authentication in first place, webseal will grant access to app1 without forcing forms based authentication, because user had already authentication mechanisam which is defined at higher level than required for app1.

Few practical requirements which I have been given by my clients are:

1. There are two URLs (VIPs) url1 and url2 pointing to same webseal. Now webseal is configured to authentication using SPNEGO for url1 only (why url2 was not configured for SPNEGO was some specific requirements). Now when user in intranet access url2 they get NTLM error page from webseal. This is expected as in the IE "Enable Integrated Windows authentication" is checked and when webseal tried to negotiate for authentication it fails to find url2 in webseals kdb file. We can not ask user to go and change browser setting every time he access url2. So solution is define authentication levels and attach the authentication level for forms authentication with the resource. As result of this when user will access url2 webseal will not negotiate with IE and simply send form for forms based authentication.


2. We configured Desktop Single Sign on for webseal. There was an application to which access was restricted to administrators. Client had a concern that if some administrator walked away from his machine and does not lock the workstation, someone can breach security and access that secured application without any authentication. So basic requirement is to enforce forms base or basic authentication when user tries to access restricted applications for rest of application it shall single sign on. Solution is same as define in first requirement, define auth levels and attach auth level to the resource.

How to setup step-up authentication in TAM:
1) Define authenitcation level in webseald-default.conf file under

authentication-levels

stanza
[authentication-levels]
level = authentication scheme
2) Create a POP and set authentication level in the POP.
Create POP:
pop create pop_name
Modify POP to define authentication level:
pop modify pop_name set ipauth anyothernw level

3) Apply POP to the required resource.
pop attach object_name pop_name

UNIX Utilities for debugging

For quite sometime I am working on IBM Tivoli Access Manager installed on AIX and Solaris servers. Very often I run into issues and over the time have learned few UNIX commands which are very helpful while debugging issues.

1. truss: It displays calls made to system libraries by the program you are running.
   truss -fae -xall -rall -vall -wall -o /{somewhere}/truss.out ./scriptname
   When you try to start a process let say pdmgrd (TAM policy server) and it fails to start, running the truss helps you find out if there was issue while loading any library or some other file.


2. coredump: contains the runtime information for a program that crashed or stops abnormally. It could be helpful to analyse the issue. On a solaris box current configuration can be viewed using 'coreadm' command.
   Per process core dump can be enabled with
   coreadm -e process
   Usually coredump file is created in same folder where process is running.
   It is necessary that user who own the process has desired permission to create the coredump. It can be verified with below command:
   ulimit -a
   


3. find a string in list of files
   find . -name "*.properties" -exec grep -i "staring to find" '{}' \; -print
   Above command search for the specified string in all the files satisfying the expression.


4. ldd: prints out dependencies and shared libraries required by the program. It is helpful to find out if program is failing to load a required library.


5. systemdef: it prints out system information like devices, version, loadable modules.


6. dispkdb: it prints out details of a certificate (kdb file) like label, dn, issued on, expires on etc. In WebSEAL when a server side certificate expires, it does not provide response to HTTPS request and shows "page can not be displayed" in browser. This command can be run as below
   /opt/PolicyDirector/sbin/dispkdb -f cert.kdb
   
   

For more details on these commands you can google around but this can atleast give you a little start. Happy debugging.[:D]