Mixing
WebSphere + IHS/ODR plugin-cfg.xml with /ibm/saml20/*
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
we are using:
- WLP 18.0.0.3
- IBM HTTP Server 8.5.5.12
we are facing a following problem in our environemnt:
Two different applications with feature samlWeb-2.0 enabled on same server are in conflict when redirected back from ADFS, maybe due to routing caused by generated plugin-cfg.xml below.
In generated plugin-cfg.xml we have :
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="**/ibm/saml20/***" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
In this case adfs authentication fails due to ODR doesnt know where to route back authenticated user.
We changed it to following:
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/applicationA_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="/ibm/saml20/applicationB_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
So when Uri was changed explicitly to correct SP endpoint it started to work. Problem is that these changes had been done manually -> Is there any way how to specify explicit SP context root for saml for particular application in collective ?
apache cluster-computing httpd.conf websphere-liberty
asked Jan 3 at 10:45
TkTzTkTz
41
add a comment |
we are using:
- WLP 18.0.0.3
- IBM HTTP Server 8.5.5.12
we are facing a following problem in our environemnt:
Two different applications with feature samlWeb-2.0 enabled on same server are in conflict when redirected back from ADFS, maybe due to routing caused by generated plugin-cfg.xml below.
In generated plugin-cfg.xml we have :
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="**/ibm/saml20/***" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
In this case adfs authentication fails due to ODR doesnt know where to route back authenticated user.
We changed it to following:
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/applicationA_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="/ibm/saml20/applicationB_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
So when Uri was changed explicitly to correct SP endpoint it started to work. Problem is that these changes had been done manually -> Is there any way how to specify explicit SP context root for saml for particular application in collective ?
apache cluster-computing httpd.conf websphere-liberty
asked Jan 3 at 10:45
TkTzTkTz
41
If you're using the ODR / Intelligent Management, these generated stanzas are not really used at runtime. You should instead check the output of /server-status to see what the dynamic view of the apps are. But f you made a change and it worked, does it mean you are not using the ODR / Intelligent Management features in the plugin?
– covener
Jan 3 at 15:32
I'm a bit confused, if they're really on the same server, the WAS Plugin can't misroute it. I could only imagine a problem if they were on different servers and the plugin-cfg.xml files were merged. Can yoou elaborate?
– covener
Jan 3 at 15:36
there also seem to be masked characters (*) added to the XML so it's really difficult to tell what your generated config looks like, much less what the requests look like on the wire.
– covener
Jan 6 at 22:38
add a comment |
we are using:
- WLP 18.0.0.3
- IBM HTTP Server 8.5.5.12
we are facing a following problem in our environemnt:
Two different applications with feature samlWeb-2.0 enabled on same server are in conflict when redirected back from ADFS, maybe due to routing caused by generated plugin-cfg.xml below.
In generated plugin-cfg.xml we have :
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="**/ibm/saml20/***" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
In this case adfs authentication fails due to ODR doesnt know where to route back authenticated user.
We changed it to following:
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/applicationA_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="/ibm/saml20/applicationB_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
So when Uri was changed explicitly to correct SP endpoint it started to work. Problem is that these changes had been done manually -> Is there any way how to specify explicit SP context root for saml for particular application in collective ?
apache cluster-computing httpd.conf websphere-liberty
asked Jan 3 at 10:45
TkTzTkTz
41
we are using:
- WLP 18.0.0.3
- IBM HTTP Server 8.5.5.12
we are facing a following problem in our environemnt:
Two different applications with feature samlWeb-2.0 enabled on same server are in conflict when redirected back from ADFS, maybe due to routing caused by generated plugin-cfg.xml below.
In generated plugin-cfg.xml we have :
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="**/ibm/saml20/***" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
In this case adfs authentication fails due to ODR doesnt know where to route back authenticated user.
We changed it to following:
<UriGroup Name="applicationA_URIs">
...
<Uri Name="/ibm/saml20/applicationA_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
<UriGroup Name="applicationB_URIs">
...
<Uri Name="/ibm/saml20/applicationB_SP/*" AffinityURLIdentifier="jsessionid" AffinityCookie="JSESSIONID"/>
...
</UriGroup>
So when Uri was changed explicitly to correct SP endpoint it started to work. Problem is that these changes had been done manually -> Is there any way how to specify explicit SP context root for saml for particular application in collective ?
apache cluster-computing httpd.conf websphere-liberty
apache cluster-computing httpd.conf websphere-liberty
asked Jan 3 at 10:45
TkTzTkTz
41
asked Jan 3 at 10:45
TkTzTkTz
41
asked Jan 3 at 10:45
TkTzTkTz
41
asked Jan 3 at 10:45
TkTzTkTz
41
asked Jan 3 at 10:45
TkTzTkTz
41
41
If you're using the ODR / Intelligent Management, these generated stanzas are not really used at runtime. You should instead check the output of /server-status to see what the dynamic view of the apps are. But f you made a change and it worked, does it mean you are not using the ODR / Intelligent Management features in the plugin?
– covener
Jan 3 at 15:32
I'm a bit confused, if they're really on the same server, the WAS Plugin can't misroute it. I could only imagine a problem if they were on different servers and the plugin-cfg.xml files were merged. Can yoou elaborate?
– covener
Jan 3 at 15:36
there also seem to be masked characters (*) added to the XML so it's really difficult to tell what your generated config looks like, much less what the requests look like on the wire.
– covener
Jan 6 at 22:38
add a comment |
If you're using the ODR / Intelligent Management, these generated stanzas are not really used at runtime. You should instead check the output of /server-status to see what the dynamic view of the apps are. But f you made a change and it worked, does it mean you are not using the ODR / Intelligent Management features in the plugin?
– covener
Jan 3 at 15:32
I'm a bit confused, if they're really on the same server, the WAS Plugin can't misroute it. I could only imagine a problem if they were on different servers and the plugin-cfg.xml files were merged. Can yoou elaborate?
– covener
Jan 3 at 15:36
there also seem to be masked characters (*) added to the XML so it's really difficult to tell what your generated config looks like, much less what the requests look like on the wire.
– covener
Jan 6 at 22:38
If you're using the ODR / Intelligent Management, these generated stanzas are not really used at runtime. You should instead check the output of /server-status to see what the dynamic view of the apps are. But f you made a change and it worked, does it mean you are not using the ODR / Intelligent Management features in the plugin?
– covener
Jan 3 at 15:32
If you're using the ODR / Intelligent Management, these generated stanzas are not really used at runtime. You should instead check the output of /server-status to see what the dynamic view of the apps are. But f you made a change and it worked, does it mean you are not using the ODR / Intelligent Management features in the plugin?
– covener
Jan 3 at 15:32
I'm a bit confused, if they're really on the same server, the WAS Plugin can't misroute it. I could only imagine a problem if they were on different servers and the plugin-cfg.xml files were merged. Can yoou elaborate?
– covener
Jan 3 at 15:36
I'm a bit confused, if they're really on the same server, the WAS Plugin can't misroute it. I could only imagine a problem if they were on different servers and the plugin-cfg.xml files were merged. Can yoou elaborate?
– covener
Jan 3 at 15:36
there also seem to be masked characters (*) added to the XML so it's really difficult to tell what your generated config looks like, much less what the requests look like on the wire.
– covener
Jan 6 at 22:38
there also seem to be masked characters (*) added to the XML so it's really difficult to tell what your generated config looks like, much less what the requests look like on the wire.
– covener
Jan 6 at 22:38
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54020745%2fwebsphere-ihs-odr-plugin-cfg-xml-with-ibm-saml20%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54020745%2fwebsphere-ihs-odr-plugin-cfg-xml-with-ibm-saml20%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
If you're using the ODR / Intelligent Management, these generated stanzas are not really used at runtime. You should instead check the output of /server-status to see what the dynamic view of the apps are. But f you made a change and it worked, does it mean you are not using the ODR / Intelligent Management features in the plugin?
– covener
Jan 3 at 15:32
I'm a bit confused, if they're really on the same server, the WAS Plugin can't misroute it. I could only imagine a problem if they were on different servers and the plugin-cfg.xml files were merged. Can yoou elaborate?
– covener
Jan 3 at 15:36
there also seem to be masked characters (*) added to the XML so it's really difficult to tell what your generated config looks like, much less what the requests look like on the wire.
– covener
Jan 6 at 22:38