Symantec Access Management

 View Only
  • 1.  Load Balanced Applications

    Posted Sep 28, 2017 01:28 PM

    Environment:

    R12 Policy Servers. R12 web agents, Windows 2008R2.

    Background: 

    We are enabling Siteminder Persistent Cookies in our Environment. We are enabling Persistent cookies and and Persistent IP check. One of the application is load balanced. 

    Issue: 

    The application behind the load balancer is changing the Session IP. When we switch to a different application SSO does not work, Reason: Client IP and Session IP does not match.  

    Question:

    Is there any ACO setting that I can use for the apps behind load balancer to avoid breaking sso. Disabling Load balancer is not an option.

    I am sure some one has encountered this issue in the past. 



  • 2.  Re: Load Balanced Applications
    Best Answer

    Posted Sep 28, 2017 01:48 PM

    The short answer is CustonIpHeader.

     

    How Custom Headers Validate IP Addresses

    The Web Agent can now use a custom HTTP header to determine a user’s IP address instead of using the REMOTE_ADDR variable. If a proxy or other device sets a custom client IP header and the Web Agent is configured to look for that header on an incoming request, the Agent uses that header as the source of the client IP information.
    In addition to configuring a custom header, you can set up a list of proxy IP addresses. If the REMOTE_ADDR matches an address in the proxy list, the Web Agent retrieves the user’s IP address from the custom header. Otherwise, the user’s IP address is obtained from the REMOTE_ADDR.
    After the Web Agent resolves the requestor’s IP address, the address is stored and used for request processing. If an address cannot be resolved, the IP address is set to unknown.
    The Web Agent logs where the client IP address was resolved from to facilitate any debugging that may be necessary.

     

    Configure IP Address Validation

    You can implement IP-address checking using the following parameters:

     

    CustomIpHeader

    Specifies an HTTP header for which the agent searches to find the IP address of the requestor. If no value is specified for this parameter, the default is an empty string. No maximum length is enforced and the value can be any string that contains a valid HTTP header value.

    Default: No

    Example: HTTP_ORIGINAL_IP

     

    ProxyDefinition

    Specifies the IP address of a proxy (such as a cache device) that requires the use of a custom HTTP header. This custom header helps the agent resolve the IP addresses of the requester.

    Default: No default

    Limits: The string must contain an IP address. Do not use server names or fully qualified DNS host names.