Usage of Evaluate IPAddress Action with wm Mediator

Transcription

1 Usage of Evaluate IPAddress Action with wm Mediator INTRODUCTION PRE-REQUISITE CONFIGURATIONS Create and configure a consumer application with IP Address Create a virtual alias in BusinessUI with Evaluate IP Address action Configure the Evaluate IP Address Action DEPLOY AND VALIDATE THE DEPLOYMENT 5. EXECUTION AND VERIFICATION OF VIRTUAL SERVICE RUNTIME INVOCATION 6. TROUBLESHOOTING WITH EVALUATE IPADRESS ACTION INTRODUCTION This tutorial will explain the configuration and usage of the runtime action " Evaluate IP Address Action" using CentraSite and wm Mediator. The Evaluate IP Address runtime policy enforcement will help in the following Identify the consumer application IP Address making the request for the virtual service if identify attribute is turned ON. Validate against a set of global or pre-registered consumer applications with IP Address in wm Mediator PRE-REQUISITE Knowledge in basics of wm Mediator runtime wm Mediator target should be created in CentraSite CentraSite configuration should be done in wm Mediator to validate the result Steps involved when using Evaluate IP Address Action in CentraSite and Mediator. Create a Consumer Application ( MyIPConsumers) with Identification token ( IP Address) and deploy it to Wm Mediator Create a virtual alias in BusinessUI Configure virtual alias with the Evaluate IP Address action for policy enforcement Deploy the virtual alias to Mediator Invoke the virtual service deployed in wm Mediator using a SOAP Client (eg. SOAPUI) Validation and troubleshooting CONFIGURATIONS Create and configure a consumer application with IP Address Login to CentraSite Control UI and Create an asset type of "Application" (eg. MyIPConsumers). Choose " IPv4 Address" as identifier and set the attribute value to the IP Address of client machine(s) where the expected request coming from Hint Choose " IPv6 Address" to identify consumers by IPv6 Address

2 a. b. Navigate to Operations -> Deployment and invoke "Deploy Consumers" tab in CentraSite Control. Select target(s) and invoke "Syncronize" to deploy the Consumer Application to wm Mediator and confirm the status as success. User can now enforce the restriction of allowing only these consumer applications or identifying the calling applications for virtual services in wm Mediator using the Evaluate IPAddress policy. Validate deployed consumer application(s) with expected attribute in wm Mediator. Open webmethods wm Mediator page, and click on "Consumers" link and verify the deployed Consumer Application is listed as in the example below Create a virtual alias in BusinessUI with Evaluate IP Address action Perform the following steps to create a virtual alias ( eg.vs_echows_ipaddress) with evaluate IP Address action Login to BusinessUI and open a service ( Eg. EchoWS) details page of the service that needs to be virtualized.. Click on " Virtualize" action to get virtualization wizard screen. Provide alias name in " Create a New Virtual Alias" input box and select an endpoint from the list of " Endpoints of <service name> to Virtualize" and click " Next". Configure the Evaluate IP Address Action Navigate to " Policy Enforcement" -> " Security" section, drag & drop " Evaluate IP Address" action into " Enforce" message flow. Click on the configure icon, the icon will appears on mouse over of " Evaluate IP Address" text in message flow. Select one of the following option to identify the consumer(s) a. " Global Consumers" - wm Mediator will try to verify the client's IP Address against a list of all global consumers available in wm Mediator. b. " Registered Consumers" - wm Mediator will try to verify the client's IP Address against the list of consumer applications which are registered as consumers with this API. c. " Do not identify" - If don't want to identify the consumer(s). Note Do not identify Does not identify the consumer, nevertheless it will evaluate the value presents in the header and the

3 request will be sent to the native service. This policy will fail if the expected value(s) is not present in the request header. Optional Step: Apply Log Invocation Policy to the virtual service and select CentraSite to the log data. This step is only required to generate and validate the events 5. Invoke " Virtualize" to complete the virtualization of the service. DEPLOY AND VALIDATE THE DEPLOYMENT Deploy the virtual alias (Eg. VS_EchoWS_IPAddress) to wm Mediator target(s) by clicking " Publish..." option from BusinessUI.

4 Verify the service deployment in wm Mediator page a. Invoke from a web browser and provide credentials to access the page. b. Click "Services" link to get list of mediated service(s) in the wm Mediator and find your virtual service (eg. VS_EchoWS_IPAddre ss). Verify virtual service definition in wm Mediator a. In the above page, click on the [VSD] link for the virtual service to see the virtual service definition. b. It should be able to find the following entries in the VSD as seen below when Global Consumers ( relax) is selected. The VSD with Evaluate IPAddress <enforcement-actions allow-anon="false"> <expressions> <expression> <params identify="relax" type="ipaddressrange" /> </expression> </expressions> </enforcement-actions> c. If Registered Consumers is selected as identify ( strict) method then the enforcement action element should be looks below. This is to identify the consumer from the register consumers list

5 Evaluate IPAddress with Registered Consumer (Strict) <enforcement-actions allow-anon="false"> <expressions> <expression> <params identify="strict" type="ipaddressrange" /> </expression> </expressions> </enforcement-actions> 5. EXECUTION AND VERIFICATION OF VIRTUAL SERVICE RUNTIME INVOCATION Find the WSDL by clicking on [WSDL] link adjacent to the service(s) list Verify the scenario by invoking the virtual service ( Eg.VS_EchoWS_IPAddress) using a SOAP Client a. Invoke the virtual service from the specified host IP client (eg ) to identify as MyIPConsumers. Execute the virtual service with a SOAP Client in the range of specified IP Address(s) in the consumer application. It can be verified in sec b. To validate anonymous access to the virtual service: Invoke the virtual service from the non-specified client IP Address range Eg. other than or not between the range of ~ , since these are NOT specified in wm Mediator's consumer application). These IPs will be rejected by wm Mediator due to the Evaluate IPAddress policy enforcement if "Don't identify" option is selected in the policy configuration at sec. The sample Virtual Service request for VS_EchoWS_IPAddress looks like <soapenv:envelope xmlns:soapenv=" xmlns:axis=" <soapenv:header/> <soapenv:body> <axis:sayhello> <axis:name>software AG</axis:name> </axis:sayhello> </soapenv:body> </soapenv:envelope> The sample Virtual Service response for VS_EchoWS_IPAddress looks like the below if the consumer successfully identified <soapenv:envelope xmlns:soapenv=" <soapenv:body> <ns:sayhelloresponse xmlns:ns=" <ns:return>hello Software AG</ns:return> </ns:sayhelloresponse> </soapenv:body> </soapenv:envelope> 5. Verifying the result with log invocation policy in BusinessUI a. View Runtime events after invoking the service as guided in step 5.2 and verify Consumer as expected. b. Successful consumer identification

6 Note ConsumerID attribute value will be set only for API keys consumers. Hence the ConsumerID's value can be ignored for now. c. Failure consumer identification. Sample Alert Message: A violation was detected for policy (Unknown-Policyuser ): Consumer could not be identified. Anonymous access is not allowed for this service! 6. TROUBLESHOOTING WITH EVALUATE IPADRESS ACTION S.No. Exception Message Description Possible cause/ Solution

7 1 Consumer could not be identified The sample fault in the response looks Mediator encountered an error:consumer could not be identified. Anonymous access is not allowed for this service! while executing operation:{ ws.apache.org/axis2}sayhello se rvice: VS_EchoWS_IPAdress at time:7 :03:44 PM on date:jun 16, 201 The client ip was: The current user:default. Make sure client(s) IP Address range matches as specified in the policy Make sure the registered consumers list has the specified IP Address in range if identify is strict.(sec. c) - Navigate to wm Mediator -> Consumers to see list of consumers (sec. b) Make sure the client sends correct IP Address in the request header as expected 2 Deployment failure: Failed to Publish The consumer application:null INMSOE0038: Policy Conflict. Policy assertion id-consumer exists multiple times Check for duplicate IP Consumer Policies and remove them from the virtual service. Duplicate policies are possible only when a user trying to apply policies for a virtual service from both CentraSite Control and BusinessUI. Only one Policy is IP Consumer allowed per service