Restricting Access to Studio

When IG is running in development mode, by default the Studio endpoint is open and accessible. To allow only specific users to access Studio, configure a StudioProtectionFilter with a SingleSignOnFilter or CrossDomainSingleSignOnFilter.

The following example uses a SingleSignOnFilter to require users to authenticate with AM before they can access Studio, and protects the request from Cross Site Request Forgery (CSRF) attacks.

Require Authentication to Access Studio in Development Mode

Set up AM:
1. (For AM 6.5.x and earlier versions) Select  Identities > demo, and set the demo user password to Ch4ng31t.
2. (For AM 6.5.3 and later versions) Select  Services > Add a Service, and add a Validation Service with the following Valid goto URL Resources:
  - http://openig.example.com:8080/*
  - http://openig.example.com:8080/*?*
3. Select Applications > Agents > Identity Gateway, add an agent with the following values:
  - Agent ID: ig_agent
  - Password: password
  Leave all other values as default.
  
  See how to set up an agent in AM 6.5.2 and earlier versions.
  1. Select Applications > Agents > Java (or J2EE).
  2. Add an agent with the following values:
    Agent ID: ig_agent
    Agent URL: http://openig.example.com:8080/agentapp
    Server URL: http://openam.example.com:8088/openam
    Password: password
  3. On the Global tab, deselect Agent Configuration Change Notification.
    This option stops IG from being notified about agent configuration changes in AM, because they are not required by IG.

Set up IG:

Set an environment variable for the IG agent password, and then restart IG:
```
$ export AGENT_SECRET_ID='cGFzc3dvcmQ='
```
The password is retrieved by a SystemAndEnvSecretStore, and must be base64-encoded.

Add the following route to IG:

$HOME/.openig/config/admin.json

%appdata%\OpenIG\config\admin.json

{
  "prefix": "openig",
  "mode": "DEVELOPMENT",
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent" : {
          "username" : "ig_agent",
          "passwordSecretId" : "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://openam.example.com:8088/openam/",
        "version": "7"
      }
    },
    {
      "name": "StudioProtectionFilter",
      "type": "ChainOfFilters",
      "config": {
        "filters": [
          {
            "type": "SingleSignOnFilter",
            "config": {
              "amService": "AmService-1"
            }
          },
          {
            "type": "CsrfFilter",
            "config": {
              "cookieName": "iPlanetDirectoryPro",
              "failureHandler": {
                "type": "StaticResponseHandler",
                "config": {
                  "status": 403,
                  "headers": {
                    "Content-Type": [
                      "text/plain"
                    ]
                  },
                  "entity": "Request forbidden"
                }
              }
            }
          }
        ]
      }
    }
  ]
}

{
  "prefix": "openig",
  "mode": "DEVELOPMENT",
  "properties": {
    "SsoTokenCookieOrHeader": "iPlanetDirectoryPro"
  },
  "connectors": [
    {
      "port": 8080
    },
    {
      "port": 8443
    }
  ],
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent" : {
          "username" : "ig_agent",
          "passwordSecretId" : "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://openam.example.com:8088/openam/",
        "ssoTokenHeader": "&{SsoTokenCookieOrHeader}",
        "version": "7"
      }
    },
    {
      "name": "StudioProtectionFilter",
      "type": "ChainOfFilters",
      "config": {
        "filters": [
          {
            "type": "SingleSignOnFilter",
            "config": {
              "amService": "AmService-1"
            }
          },
          {
            "type": "CsrfFilter",
            "config": {
              "cookieName": "&{SsoTokenCookieOrHeader}",
              "failureHandler": {
                "type": "StaticResponseHandler",
                "config": {
                  "status": 403,
                  "headers": {
                    "Content-Type": [
                      "text/plain"
                    ]
                  },
                  "entity": "Request forbidden"
                }
              }
            }
          }
        ]
      }
    }
  ]
}

Notice the following features of the file:

The prefix sets the base of the administrative route to the default value /openig. The Studio endpoint is therefore /openig/studio.
The mode is development, so by default the Studio endpoint is open and unfiltered.
The properties object sets a configuration parameter for the value of the SSO token cookie or header, which is used in AmService and CorsFilter.
The AmService uses the IG agent in AM for authentication.
The agent password for AmService is provided by a SystemAndEnvSecretStore in the heap.
The StudioProtectionFilter calls the SingleSignOnFilter to redirect unauthenticated requests to AM, and uses the CsrfFilter to protect requests from CSRF attacks. For more information, see "SingleSignOnFilter" and "CsrfFilter".

Restart IG to take into account the changes to admin.json.

Test the setup:
1. If you are logged in to AM, log out.
2. Go to http://openig.example.com:8080/openig/studio. The SingleSignOnFilter redirects the request to AM for authentication.
3. Log in to AM with user demo, password Ch4ng31t. The Studio Routes screen is displayed.