IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Handling
invalid
character
encoding
in
URL
query
strings
Problem:
It
is
possible
for
the
query
string
of
a
URL
to
contain
character
encoding
that
is
unacceptable
to
WebSEAL,
and
therefore
rejected
by
WebSEAL.
For
example,
a
query
string
containing
binary
encoding
is
rejected
by
WebSEAL.
The
problem
of
invalid
character
encoding
is
caused
by
the
specific
requirements
of
the
back-end
server
application.
In
a
typical
scenario,
the
client
makes
a
request
to
this
back-end
application.
The
request
includes
a
query
string,
required
by
the
back-end
application,
but
containing
character
encoding
unknown
to
WebSEAL.
WebSEAL
returns
a
″Bad
Request″
(400)
error.
The
error
log
contains
a
message
such
as:
″Illegal
character
in
URL.″
Solution:
The
solution
to
the
problem
of
invalid
character
encoding
is
to
configure
WebSEAL
to
completely
ignore
the
query
string.
The
query
string
component
of
the
URL
can
then
be
passed
unchanged
to
the
back-end
application.
However,
if
WebSEAL
is
configured
to
ignore
the
query
string
component,
then
dynamic
URL
mapping
for
authorization
checking
must
be
disabled.
If
this
compromise
is
acceptable
for
your
WebSEAL
environment,
perform
the
following
two
changes
to
the
WebSEAL
configuration
file:
1.
Disable
the
dynurl-map
parameter
with
a
comment
character:
[server]
#dynurl-map
=
bin/dynurl.conf
2.
Manually
add
the
decode-query
parameter
and
set
it
equal
to
″no″:
[server]
decode-query
=
no
The
default
behavior
when
decode-query
is
not
defined
is:
decode-query
=
yes
If
you
disable
dynurl-map
and
fail
to
add
decode-query,
the
WebSEAL
process
does
not
start.
Chapter
2.
WebSEAL
server
configuration
55