First time user login backUrl stores the value of the url requested in the case of 10 g (SDK) webgate

IOM - OAM 11gR2PS2 and 10g protected webgate application integration.

When new users trying to access to protected application the user redirected to the screen for the IOM change password (which is correct behavior) and here once the user change the password and submit does not load the protected application. SST If g 11 protected asks consulted then it works fine. Here's the use case:

To access the OHS 11 g protected page IOM: https:// < LBR_URL >: 4443/identity /

the user redirects to - >

https:// < LBR_URL >: 4443/identity/faces/firstloginbackUrl=https%3A%2F%2F < LBR_URL > % 3 A 4443% 2Fidentity & _afrWindowMode = 0 & checksum = A9745E7CE5D7A5B96116C67FB2BBA09...

Above you can see backUrl stores the value of the requested url.

after a successful change password user redirected to - > https:// < LBR_URL >: 4443/identity/which is expected.

Now with 10g Webgate (jboss) protected:

10 g webgate protected access request as https://ABCD.com:8443/ShoppingCart/default.htm

the user makes a redirect to - > https:// < LBR_URL >: 4443/identity/faces/firstlogin?backUrl=%2Fidentity%2Ffaces%2Fsignin & _afrWindowMode = 0 & checksum = F35AFC1E9A9734D0FC583669B3DD62105F897B332B7303044855B9B0CC42C072 & _afrLoop = 371...

Now you can see backUrl NOT stores the value of the requested url and some URLs as maintaining == / faces/registration.

after successful change password user redirected to->https://< LBR_URL >: 4443, identity, faces, signin? _afrLoop = 3715664044314206 & _adf.ctrl - State = fq36gphqz_77


Is there a limitation with this? I couldn't see any parameter that allows to control this on webgate 10g.


Vinay

Too bad I got the answer.

If you see the newspapers you can see the warning like:

XL not defined AllowedBackURLsMode

In version IOM 11.1.2.1.4 has introduced a new improved security to prevent the use of a backurl to redirect a user to a malicious url.

It can be controlled by XL. AllowedBackURLs.

-

Vinay

Tags: Fusion Middleware

Similar Questions

Maybe you are looking for