[OAM] Redirection in Custom Authentication Plug-in API

In Authentication API you can set HTTP Header variable(s) or Cookie(s), just like setting authentication success and failure via the Policy Manager UI.

For example, if you are using C# managed code, the program fragment will be something like this:

info.get_ActionInfo().SetAction("Cookie:ANResult","NOTALLOWED",IObAuthnPlugin.ActionType.ObAnFailFixedVals);
info.get_ActionInfo().SetAction("HeaderVar:ANResult","NOTALLOWED",IObAuthnPlugin.ActionType.ObAnFailFixedVals);

Using the above code, when authentication is failed (ObAnFailFixedVals),
- a cookie ANResult will contain the value "NOTALLOWED"; and
- a HTTP header variable ANResult will contain the value "NOTALLOWED"

In fact, you can also redirect the user to a particular webpage (URL) by using the same method (SetAction()) with the first argument "redirectURL", e.g.

info.get_ActionInfo().SetAction("redirectURL","/failed.asp",IObAuthnPlugin.ActionType.ObAnFailRedirect);

The above line will redirect the user to /failed.asp if authentication is failed.

[OAM] Duplicate Action and Custom Plug-in

In OAM, you can config how to handle duplicate action for the authorization rule (details can be found in the OAM documentation).

What is duplicate action?

As mentioned in the doc, if the action of one rule is set a HTTP header variable text string and the action of another rule is set the variable to a different value, a conflict occurs when both rules return values. Setting duplicate action helps conflict resolution.

A more detail example:

• You have the first AuthZ Expression - Allow Everyone with Action to return a value HELLOALL in HTTP_TEST.
• You have a second AuthZ Expression - Allow Admin with Action to return a value HELLOADMIN in HTTP_TEST.
• You have a AuthZ Rule in the Policy using (Allow Everyone & Allow Admin)
• WebGate supports only single value in header variable. By default, WebGate only return the last value. However, you can set duplicate action to "Ignore Duplicate" so that only the FIRST value can return (of coz, you can also set duplicate action to "Override" so that only the last instance will be returned. If you are using AccessGate, you can also set it to "Duplicate" to return all values).
  

How about HTTP header with Custom AuthZ Plugin?

However, please be reminded that the duplicate action will NOT handle HTTP header which set with Custom AuthZ Plug-in (a sample of AuthZ plugin which returns HTTP header variable can be found in metalink doc id 781073.1).