KB483600: Library Requirements for the PUT and DELETE HTTP Methods When Using Trusted Authentication with IBM Security Access Manager (Tivoli)

Starting with the release of Strategy ONE (March 2024), dossiers are also known as dashboards.

Description

Multiple problems and errors occur when a SSO solution is created using trusted authentication login with IBM Security Access Manager.

Why is this happening?

Library requires both the PUT and DELETE http methods to be allowed by the trusted provider. In ISAM, they are blocked by default, so errors occur. This affects Library functionality, so these http methods must be allowed.

Example

Users that do not have dossiers in Library during the moment of login that are also using ISAM, cannot view the welcome dialog that uses the PUT http method. This is because the ISAM policy server (WebSeal) blocks both local and remote PUT requests.

Solution

The ISAM administrator needs to perform the following steps:

• Log into the ISAM administrative console.
• Choose Secure Web Settings > Reverse Proxy.
  

• Select your reverse proxy.
• Go to Manage > Configuration > Edit configuration file. We recommend that you backup the current configuration file by exporting it.
  

• In the configuration file, look for the method disablement section, which looks similar to what is shown below.
  

  
  #---------------------
  # Method disablement
  #---------------------
  # Specify the HTTP methods which should be blocked when requesting local or remote
  # resources. Multiple methods should be separated with a comma (',').  For example, to
  # block access to the TRACE and PUT methods over local junctions the configuration entry
  # would be:
  # http-method-disabled-local = TRACE,PUT
  #
  http-method-disabled-local = TRACE,PUT,DELETE,CONNECT
  http-method-disabled-remote = TRACE,PUT,DELETE,CONNECT
  

  
  
• Remove the PUT http method from both local and remote.
  

• Repeat the same steps for the DELETE http method.
• Save your changes.
• Commit your changes.
• Restart the reverse proxy.
• From the Home Administrative Control Panel, go to Secure Web Setttings > Policy Administration.
  

• Once you are logged in, go to the ACLs.
• Click on the ACL that is applied to your Object Space (junction). The default name is default-webseal.
  

• Create an ACL entry.
  

• Select an entry type of Any-other.
• Assign Traverse, Modify, Read, and Execute. Modify is the new addition.
  

• Click Apply.
  

• Once these changes are complete, the error no longer appears when using trusted authentication with ISAM.