Policy enforcement

Select Authorization > Policy Sets > New Policy Set, and add a policy set with the following values:

In the policy set, add a policy with the following values:

On the Actions tab, add an action to allow HTTP GET.

On the Subjects tab, remove any default subject conditions, add a subject condition for all Authenticated Users.

In your browser’s privacy or incognito mode, go to https://ig.example.com:8443/home/pep-sso.

If you see warnings that the site isn’t secure, respond to the warnings to access the site.

Log in to AM as user demo, password Ch4ng31t.

In the AM admin UI, click Realms and add a realm named alpha. Leave all other values as default.

Select Services > Add a Service and add a Validation Service with the following Valid goto URL Resources:

Register a PingGateway agent with the following values, as described in Register a PingGateway agent in AM:

(Optional) Authenticate the agent to AM as described in Authenticate a PingGateway agent to AM.

Add a policy:

Set up PingGateway for HTTPS, as described in Configure PingGateway for TLS (server-side).

Set an environment variable for the PingGateway agent password, and then restart PingGateway:

$ export AGENT_SECRET_ID='cGFzc3dvcmQ='

Add the following route to PingGateway to serve the sample application .css and other static resources:

$HOME/.openig/config/routes/00-static-resources.json

%appdata%\OpenIG\config\routes\00-static-resources.json

{
  "name" : "00-static-resources",
  "baseURI" : "http://app.example.com:8081",
  "condition": "${find(request.uri.path,'^/css') or matchesWithRegex(request.uri.path, '^/.*\\\\.ico$') or matchesWithRegex(request.uri.path, '^/.*\\\\.gif$')}",
  "handler": "ReverseProxyHandler"
}

Add the following route to PingGateway:

$HOME/.openig/config/routes/04-pep-sso-realm.json

%appdata%\OpenIG\config\routes\04-pep-sso-realm.json

{
  "name": "pep-sso-realm",
  "baseURI": "http://app.example.com:8081",
  "condition": "${find(request.uri.path, '^/home/pep-sso-realm')}",
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent": {
          "username": "ig_agent",
          "passwordSecretId": "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://am.example.com:8088/openam/",
        "realm": "/alpha"
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "name": "SingleSignOnFilter-1",
          "type": "SingleSignOnFilter",
          "config": {
            "amService": "AmService-1"
          }
        },
        {
          "name": "PolicyEnforcementFilter-1",
          "type": "PolicyEnforcementFilter",
          "config": {
            "application": "PEP-SSO-REALM",
            "ssoTokenSubject": "${contexts.ssoToken.value}",
            "amService": "AmService-1"
          }
        }
      ],
      "handler": "ReverseProxyHandler"
    }
  }
}

In your browser’s privacy or incognito mode, go to https://ig.example.com:8443/home/pep-sso-realm.

If you see warnings that the site isn’t secure, respond to the warnings to access the site.

Log in to AM as user demo, password Ch4ng31t.

In the AM admin UI, select Applications > Agents > Identity Gateway, and change the redirect URL for ig_agent_cdsso:

Select Authorization > Policy Sets > New Policy Set, and add a policy set with the following values:

In your browser’s privacy or incognito mode, go to to https://ig.ext.com:8443/home/pep-cdsso.

If you see warnings that the site isn’t secure, respond to the warnings to access the site.

Log in to AM as user demo, password Ch4ng31t.

Select the policy PEP-SSO and add a new resource:

In the same policy, add the following subject condition:

In your browser’s privacy or incognito mode, go to https://ig.example.com:8443/home/pep-claims.

If you see warnings that the site isn’t secure, respond to the warnings to access the site.

Log in to AM as user demo, password Ch4ng31t.

In your browser’s privacy or incognito mode, go to https://ig.ext.com:8443/home/pep-sso.

If you see warnings that the site isn’t secure, respond to the warnings to access the site.

Log in to AM as user demo, password Ch4ng31t.

In a separate terminal, log on to AM as admin, and change the PEP-SSO policy. For example, in the Actions tab, add an action to allow HTTP DELETE.

Note that the PingGateway system logs are updated with Websocket notifications about the change:

... | TRACE | vert.x-eventloop-thread-14 | o.f.o.t.n.w.l.DirectAmLink | @system | Received a message: ... "policy": "PEP-SSO", "policySet": "PEP-SSO", "eventType": "UPDATE" } }
... | TRACE | vert.x-eventloop-thread-14 | o.f.o.t.n.w.SubscriptionService | @system | Notification received, ... "policy": "PEP-SSO", "policySet": "PEP-SSO", "eventType": "UPDATE" }}
... | TRACE | vert.x-eventloop-thread-14 | o.f.o.t.n.w.SubscriptionService | @system | Notification sent to a [/agent/policy] listener

Select a policy set:

In the policy, select Environments, and add the following environment condition:

Select Scripts > Scripted Module - Client Side, and replace the default script with the following script:

autoSubmitDelay = 60000;

function callback() {
    var parent = document.createElement("div");
    parent.className = "form-group";

    var label = document.createElement("label");
    label.className = "sr-only separator";
    label.setAttribute("for", "answer");
    label.innerText = "Verification Code";
    parent.appendChild(label);

    var input = document.createElement("input");
    input.className = "form-control input-lg";
    input.type = "text";
    input.placeholder = "Enter your verification code";
    input.name = "answer";
    input.id = "answer";
    input.value = "";
    input.oninput = function(event) {
        var element = document.getElementById("clientScriptOutputData");
        if (!element.value || element.value == "clientScriptOutputData") element.value = "{}";
        var json = JSON.parse(element.value);
        json["answer"] = event.target.value;
        element.value = JSON.stringify(json);
    };
    parent.appendChild(input);

    var fieldset = document.forms[0].getElementsByTagName("fieldset")[0];
    fieldset.prepend(parent);
}

if (document.readyState !== 'loading') {
    callback();
} else {
    document.addEventListener("DOMContentLoaded", callback);
}

Select Scripts > Scripted Module - Server Side, and replace the default script with the following script:

username = 'demo'
logger.error('username: ' + username)

// Test whether the user 'demo' enters the correct validation code
data = JSON.parse(clientScriptOutputData);
answer = data.answer;

if (answer !== '123456') {
  logger.error('Authentication Failed !!')
  authState = FAILED;
} else {
  logger.error('Authenticated !!')
  authState = SUCCESS;
}

Select Authentication > Modules, and add a module with the following settings:

In the authentication module, enable the option for client-side script, and select the following options:

Add the authentication module to an authentication chain:

Log out of AM.

Access the route:

Log in to AM as user demo, password Ch4ng31t.

In the session upgrade window, enter the verification code 123456.

Select the policy set:

In the PingGateway policy, select Environments and add another environment condition:

Select Scripts > New Script, and add the following client-side script:

Select Scripts > New Script, and add the following server-side script:

Select Authentication > Modules, and add a module with the following settings:

In the authentication module, enable the option for client-side script, and select the following options:

Log out of AM.

In your browser’s privacy or incognito mode, access your route:

If you see warnings that the site isn’t secure, respond to the warnings to access the site.

Log in to AM as user demo, password Ch4ng31t.

Enter the verification code 123456 to upgrade the authorization level for the session to 1.

In the transaction upgrade window, enter the verification code 789.