0

Let's say there is an application server that runs multiple web applications. Some of these applications are accessible directly from the Internet, however a specific application requires single-sign-on, which is implemented via a reverse proxy solution that adds the proper HTTP headers. This reverse proxy implementation is running on a different box inside the company network. What are the typical ways to enforce that this particular application only processes request that are "through the SSO" (through the reverse proxy), but not the ones coming directly from the internet?

Some ideas:

  • Simply check the request IP and see if that matches the proxy's
  • Require an SSL client sertificate to be sent by the reverse proxy
  • Do not care about the source of the incoming HTTP request, but check with the SSO if the HTTP headers included are for a valid SSO session or not

What are the pros and cons of each approach? How did you implement something similar? The particular SSO implementation is IBM WebSeal, but I'm also interested in how you've solved the problem with any other product as well. thanks!

|improve this question
  • Question is leaning towards being off-topic unless OP edits Q to be networking focused. I'll provide a network-based answer. – generalnetworkerror Jul 4 '15 at 8:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 11 '17 at 18:23
  • @RonMaupin See my comment below to the answer received. Unfortunately I don't have a solution either yet.. – Istvan Devai Aug 29 '17 at 18:51
  • OK. We are just seeing if there are questions that we can clean up. There have been dozens and dozens of answers accepted from this campaign, but if you have not received an acceptable answer, then the question should remain open. – Ron Maupin♦ Aug 29 '17 at 18:54
1

From a networking perspective, the app that requires access only from your reverse proxy should ideally be running on a system (internal subnet/vlan) not accessible from the Internet directly. In fact, my preference would be to have all the apps behind the load balancer so that there is no direct path to the servers. If the app is tied to the code base used for all apps, you might be able to duplicate all the apps on an internal system that effectively only runs the SSO site (since it only receives those requests from the reverse proxy) and somehow render the SSO-site on the directly accessible system useless.

Another viable solution is to have an ACL on the site so that only the load-balancer can make requests to the app.

A solution not viable from a security POV would be to have public and private subnets mixed on your web host for handling your two use-cases.

|improve this answer
  • Thank you for your suggestions. I understand that the above are valid solutions, however I'm looking for the solution using the way of operation outlined above (both the SSO proxy and the public internet can access the server). – Istvan Devai Aug 29 '17 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.