← Back to plugin index

Cookie Mapping
Description
A mapping from a source cookie to a target cookie sent to the Airlock Gateway (WAF) or the client.
Type name
CookieMapping
Class
com.airlock.iam.core.misc.impl.sso.onbehalflogin.CookieMapping
May be used by
On Behalf Login Identity Propagator Access Cookie Identity Propagator On Behalf Login Identity Propagation SAML Access Cookie Identity Propagator
Properties
Source Access Cookie Name (sourceAccessCookieName)
Description
The name of the access cookie to be extracted from the HTTP response of the application providing access cookies.
Attributes
String
Mandatory
Example
ACCESS_COOKIE
Example
AUTH_USER
Target Access Cookie Name (targetAccessCookieName)
Description
The name of the access cookie to be sent to the browser or entry server. If this property is not defined, the name of the fetched access cookie is used.
Attributes
String
Optional
Example
ACCESS_COOKIE
Example
AUTH_USER
Target Access Cookie Path (targetAccessCookiePath)
Description
The path for which the cookie is set. The path determines where the cookie is sent by the reverse proxy (or browser).

If the same access cookie is used for all applications, the value "/" can be used. If different tickets are used for different applications, the applications path should be used.

Note that only one access cookie per cookie path and name can exist. Make sure that this cookie name does not clash with other cookie's names. For example, do not use session cookie names such as "JSESSIONID".

Make sure the configuration flag Interpret Cookie Domains is set in the Airlock Gateway (WAF) configuration. If not the cookie path is ignored and cookies in the cookie store are sent to any backend HTTP request of the same session. This also means that there may be only one cookie per cookie name!
It is best to consult the corresponding documentation of the web entry server or reverse proxy to get more accurate information on cookie handling.

Attributes
String
Optional
Default value
/
Example
/
Example
/appl1
Example
/appl2
Target Access Cookie Domain (targetAccessCookieDomain)
Description
The domain for which the cookie is set. The domain determines where the cookie is sent by the reverse proxy (or browser).

Because of security restrictions in browsers (same origin policy) it is usually not possible to set a cookie for a different domain unless the right-most two domain parts (e.g. "ergon.ch") are equal to that of the application setting the cookie.
It is possible that there are further restrictions regarding this in browsers.

If you are using a HTTP reverse proxy that stores the cookie in its session store (and does not send it to the client), make sure to understand the proxies interpretation of the cookie domain and cookie path.

Make sure the configuration flag Interpret Cookie Domains is set in the Airlock Gateway (WAF) configuration. If not the cookie domain is ignored and cookies in the cookie store are sent to any backend HTTP request of the same session. The cookie path is also ignored meaning that there may be only one cookie per cookie name!
The Airlock Gateway also supports the following cookie domain values (if the flag Interpret Cookie Domains is set):

  • The value .* results in cookies being sent to all backend servers. This is especially useful if one authentication ticket is used for multiple backends.
  • The value @<fully-qualified-host> results in the cookie being treated as if it were set by the host specified by "<fully-qualified-host>". If using this value, make sure the corresponding mapping also uses the fully qualified hostname.
It is best to consult the corresponding documentation of the web entry server or reverse proxy to get more accurate information on cookie handling.

Note that only one cookie per cookie path and name can exist. Make sure that this cookie name does not clash with other cookie's names. For example, do not use session cookie names such as "JSESSIONID".

Attributes
String
Optional
Example
.*
Example
@172.16.1.1:80
Set Secure Flag Target Access Cookie (setSecureFlagTargetAccessCookie)
Description
If set to TRUE the "secure"-flag of the cookie is set.

If the cookie is marked as secure, the browser (and any HTTP proxy behaving like a browser) should send the cookie only over secure connections.
Caution: If you think that setting this flag makes your application more secure, it is in most cases way better to adequately secure the access cookie by encrypting it appropriately. Remember that this flag just "asks" the browser to not transmit the cookie over unencrypted connections.

Attributes
Boolean
Optional
Default value
false
URL Encode Target Cookie Value (urlEncodeTargetCookieValue)
Description
If set to TRUE the value from the fetched cookie is not passed as is to the response but it is URL-encoded (using UTF-8 encoding).
Attributes
Boolean
Optional
Default value
false
Mandatory (mandatory)
Description
If set to TRUE the cookie must be present in the response or the process will fail.
Attributes
Boolean
Optional
Default value
true
YAML Template (with default values) 

type: CookieMapping
id: CookieMapping-xxxxxx
displayName: 
comment: 
properties:
  mandatory: true
  setSecureFlagTargetAccessCookie: false
  sourceAccessCookieName:
  targetAccessCookieDomain:
  targetAccessCookieName:
  targetAccessCookiePath: /
  urlEncodeTargetCookieValue: false