Duplicate Oracle SSO URL to exclude if URL has a specific parameter

Question

We currently support SSO in our web application and work well. But, when the user is configured in SSO, but not in our web application, we have a redirect cycle.

We noticed that when this happens, webapp calls this URL:

/login.jsp?errormsg=The+User%3A+SOMEUSER+doesn%27t+exist 

And my forced url configuration is as follows:

 com.sun.identity.agents.config.notenforced.uri[0] = / com.sun.identity.agents.config.notenforced.uri[1] = /-*-.jsp com.sun.identity.agents.config.notenforced.uri[2] = /-*-.jsp* com.sun.identity.agents.config.notenforced.uri[3] = /-*-.jsp?* ... com.sun.identity.agents.config.notenforced.uri.invert = true 

I use all jsps for verification through SSO. But, what I want to do is define a URI, for example:

• If you are making a .jsp call but it does not have the errormsg parameter, check the session through SSO;
• But if .jsp is called and the errormsg parameter is in the url, don’t check it, release it.

The thing is, can I use regular expressions for SSO URIs? Because these patterns

/ - * -. Jsp

as far as I know, are not regular expressions.

How can I create this filter?

Answer 1

You are right in thinking that the template is not a forced list in AMAgent.properties is not a regular expression. It seems to you that you have already discovered that it uses a much more limited permutation matching syntax .

The answer to the question "Can I use regular expressions for SSO URIs?" it seems not. Unfortunately, what can be done here is very limited because the syntax does not include a way to exclude certain characters or phrases. Without further understanding of the requirements, my best suggestion would be to use an exception list rather than an include list:

 com.sun.identity.agents.config.notenforced.uri[0] = /-*-.jsp?errormsg* ... 

(with com.sun.identity.agents.config.notenforced.uri.invert = false )

Of course, you may need to add many more entries to this list, and it may become large, but at least it is more in line with Oracle recommendations:

When the inverted list is not inverted, the amount of resources for which the agent will not exercise access control is potentially very large. Therefore, the use of this feature should be used with extreme caution and only after an extensive safety assessment of the requirements of deployed applications.