← Back to plugin index

On Behalf Login Identity Propagation
Description

This identity propagator performs a login 'on behalf' of the user at a backend web application. It performs the necessary login steps to obtain an authenticated session from login into the backend application. Then it attaches the session cookie to the user's authenticated session, thus enabling access to the backend application.

The login process is configured as a sequence of on behalf login steps. Each on behalf login step performs a HTTP operation and can store newly gathered information in an information storage for the next step.

For example: A first on behalf login step executes a HTTP GET request on the web application's login page and extracts the CSRF protection token. A next on behalf login step submits the login form with username, password and the extracted CSRF token.

On behalf logins are not robust against changes of the web application. Therefore, this identity propagation mechanism is only recommended for legacy application that do not accept another way of identity propagation.

Type name
OnBehalfLoginIdentityPropagation
Class
com.airlock.iam.authentication.application.configuration.idpropagation.OnBehalfLoginIdentityPropagationConfig
May be used by
One-Shot Target Application Target Application
Properties
HTTP Client (httpClient)
Description
The HTTP client that connects to the web application.
Attributes
Plugin-Link
Mandatory
Assignable plugins
HTTP Client Config HTTP Client With Client Certificate
On Behalf Login Steps (onBehalfLoginSteps)
Description
Sequence of on behalf login steps that are performed to simulate the user's login process.
Attributes
Plugin-List
Mandatory
Assignable plugins
CSRF Token Extraction Step HTTP GET Step HTTP POST Step
Cookie Mappings (cookieMappings)
Description
A list of cookies that are expected from the backend application and that are kept for subsequent access to this backend. Usually the only cookie to configure is the session cookie.
Attributes
Plugin-List
Mandatory
Assignable plugins
Cookie Mapping
Forward To Last Redirect Location (forwardToLastRedirectLocation)
Description
If enabled, the client will be redirected to the URL specified in the Location header in the response of the last "On Behalf Login Step", under the conditions that
  1. a forward location is present in the last response from the backend and
  2. the forward location matches at least one regex in the "Allowed Forward Location" patterns.
Attributes
Boolean
Optional
Default value
false
Allowed Forward Locations (allowedForwardLocations)
Description
A list of regular expressions defining the allowed forward locations in the response of the last "On Behalf Login Step".
This setting is only relevant if "Forward User To Last Redirect Location" is enabled. In that case the forward location must match at least one regex in order to be accepted. If the forward location does not match any regex, the default forward location is used.
  • The forward location will always be an absolute URL, relative URLs are not supported.
  • The forward location is from the on behalf HTTP clients perspective, which might be different from the users perspective, if Airlock IAM is behind an Airlock Gateway. This is because the Airlock Gateway may rewrite the forward location.
  • URLs with any 'User Information' part in front of the host name (for example "https://user@domain.com/") are never accepted.
Attributes
RegEx-List
Optional
Default value
[^/.*]
Value Providers (valueProviders)
Description
Providers for all values that will be available to perform the on-behalf steps. In the plugin documentation of the steps they are referred as "values provided to the identity propagation".
Attributes
Plugin-List
Optional
Assignable plugins
Additional Password Check Attribute Map Airlock 2FA Authentication Data Map Airlock 2FA Login ID Parameter Authentication Data Map Conditional Value Map Provider Context Data Map Edited Context Data Map Generic Session Attribute Value Map Provider HTTP Request Information Map OAuth 2.0 Credential Context Data Map OAuth 2.0 Tokens Map Roles Provider SSI Verification Data Provider SSO Ticket Context Data Provider Script Execution Result Value Map Provider Transaction Approval Parameters Map Transforming Value Map Provider User Identity Map User Passwords Map User Statistics Map Value Provider Map mTAN Token Flow Value Map
Condition (condition)
Description
Defines the condition under which this identity propagation is executed.
Attributes
Plugin-Link
Optional
Assignable plugins
Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)
YAML Template (with default values) 

type: OnBehalfLoginIdentityPropagation
id: OnBehalfLoginIdentityPropagation-xxxxxx
displayName: 
comment: 
properties:
  allowedForwardLocations: [^/.*]
  condition:
  cookieMappings:
  forwardToLastRedirectLocation: false
  httpClient:
  onBehalfLoginSteps:
  valueProviders: