IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

non-validated
content
is
passed
through
to
the
application
server.
If
the
application
server
does
not
have
its
own
authorization
capabilities,
the
situation
might
result
in
a
security
risk.
The
dynurl-allow-large-posts
parameter
allows
you
to
control
the
way
WebSEAL
handles
POST
requests
that
have
a
content
length
larger
than
that
specified
by
request-body-max-read.
If
the
parameter
value
is
set
to
“no”
(default),
WebSEAL
rejects,
in
total,
any
POST
request
with
a
content
length
larger
than
that
specified
by
request-body-max-read.
[server]
dynurl-allow-large-posts
=
no
If
the
parameter
value
is
set
to
“yes”,
WebSEAL
accepts
the
entire
POST
request,
but
only
validates
the
amount
of
content
equal
to
the
request-body-max-read
value.
[server]
dynurl-allow-large-posts
=
yes
Example
1:
v
A
large
POST
request
is
received
(greater
than
the
request-body-max-read
value).
v
dynurl-allow-large-posts
=
no
v
Dynamic
URLs
are
enabled.
v
Result:
500
“Server
Error”
Example
2:
v
A
large
POST
request
is
received
(greater
than
the
post-request-body-max-read).
v
dynurl-allow-large-posts
=
yes
v
Dynamic
URLs
are
enabled.
v
Result:
WebSEAL
compares
the
amount
of
content
up
to
request-body-max-read
with
each
of
the
regular
expressions
in
the
dynurl.conf
configuration
file,
and
performs
an
authorization
check
on
the
corresponding
object
if
a
match
is
found.
Otherwise,
the
authorization
check
is
performed
on
the
object
corresponding
to
the
URL
received,
as
usual.
The
portion
of
the
request
body
past
request-body-max-read
is
not
validated.
v
The
following
template
contains
the
type
of
pattern
matching
arrangement
that
invites
misuse
by
a
large
POST
request:
/rtpi153/webapp/examples/HitCount\?*action=reset*
Summary
and
technical
notes
Summary:
v
To
configure
WebSEAL
to
securely
handle
dynamic
URLs,
create
the
following
file:
/opt/pdweb/www/lib/dynurl.conf
v
The
file
must
contain
one
or
more
lines
of
the
format:
object
template
v
If
the
file
does
not
exist,
or
is
empty,
dynamic
URL
capability
is
not
enabled.
v
After
the
file
has
been
processed,
the
object
name
appears
as
a
child
resource
in
the
WebSEAL
object
space.
v
The
template
can
contain
a
subset
of
the
standard
pattern
matching
characters.
The
template
can
also
be
an
exact
string
with
no
pattern
matching
characters.
Chapter
12.
Application
integration
351