Table of contents

Table of contents

1. Airlock Secure Access Hub

1.1. Semantic versioning scheme for Airlock Secure Access Hub components

2. About this document

2.1. Leveled prerequisites

2.2. General warnings and recommendations

2.3. Warning tiers in this document

2.4. Additional panel types

2.5. Advanced Lucene searches within this online help

3. General warnings and recommendations

4.1. Introduction

4.2. Features and support

5. Release notes

5.1. Release notes 3.2

5.1.1. Airlock Microgateway Changelog 3.2

6. Requirements

7. Getting Started

7.1. Docker Hub repository

7.2. Deploy a minimal setup

7.2.1. Deploy with kubectl in Kubernetes

7.2.2. Deploy with kubectl in OpenShift

7.2.3. Deploy with Helm in Kubernetes

7.2.4. Deploy with Helm in OpenShift

8. System architecture

8.1. Cascaded services

8.2. Airlock Microgateway protecting Airlock IAM

8.2.1. Protecting Airlock IAM with a single Microgateway

8.2.2. Protecting Airlock IAM with separate Microgateways and shared session store

8.2.3. Protecting Airlock IAM with separate Microgateways and JWT access tokens

9. Basic concepts

9.1. Microgateway architecture and interfaces

9.2. Microgateway configuration concepts

9.3. Microgateway request processing steps

9.4. Cookie handling and cookie types

9.5. Microgateway filtering rules

9.5.1. Basic concepts: Allow rules

9.5.2. Basic concepts: Deny rules

9.5.3. Basic concepts: JSON filtering

9.6. JWKS access tokens

9.6.1. JWKS and JWK selection by filtering

9.7. Cross-Site Request Forgery (CSRF) protection

9.8. Entry path to back-end path settings

9.8.1. Entry path as Directory or Regular expression

9.8.2. Option Enforce trailing slashes

10. Configuration

10.1. Airlock Microgateway DSL

10.1.1. Automatic YAML validation during editing

10.1.2. Workarounds for options that are not available as DSL option

10.2. External files in dedicated folders

10.3. Custom error pages

10.4. Environment variables

10.5. Migrating from an appliance setup

11.1. Integration

11.1.1. Configuration of allow rules

11.1.2. Configuration of deny rules

11.1.3. Configuration of request and response actions

11.1.4. Content rewriting

11.1.5. Session handling

11.1.6. Replacement of back-end error pages

11.1.7. OpenAPI specification validation

11.1.8. Configure Cross-Side Request Forgery (CSRF) protection for SPAs

11.2. Access control

11.2.1. Access management with Airlock IAM

11.2.2. Access control with JWKS

11.3. Operation

11.3.1. Readiness and Liveness probes

11.3.2. Logging and reporting

11.3.3. Microgateway as a data source for Prometheus metrics

11.3.4. Premium Edition: Licensing

11.3.5. Limitations of the Community Edition

11.4. Best Practices

11.4.1. Use Microgateway for all stages

12.1. A more complex configuration file

12.2. Airlock Minikube example

13.1. Exercises

13.1.1. Getting started

13.1.2. Protecting a backend service

13.1.3. Readiness and Liveness Probes

13.1.4. OpenAPI

13.1.5. Deny rules

13.1.6. Metrics

13.1.7. Session handling

13.1.8. Access control with Airlock IAM

13.2. Tutorial FAQ

13.2.1. Deploy the solution

13.2.2. Delete previously deployed Kubernetes resources

14. Troubleshooting

14.1. KB - Configbuilder errors during startup

14.2. KB - Secure flag of cookies

14.3. KB - Protocol mismatch causes service unavailability

14.4. KB - Max body size causes status code 413

14.5. KB – Cookie parsing according to RFC 6265

15.1. DSL reference

15.2. Default mapping template

15.3. Default deny rule groups

15.3.1. Deny Rule Group – (default) SQL Injection (SQLi) in Parameter Value

15.3.2. Deny Rule Group – (default) SQL Injection (SQLi) in Header Value

15.3.3. Deny Rule Group – (default) Cross-Site Scripting (XSS) in Parameter Value

15.3.4. Deny Rule Group – (default) Cross-Site Scripting (XSS) in Header Value

15.3.5. Deny Rule Group – (default) Cross-Site Scripting (XSS) in Path

15.3.6. Deny Rule Group – (default) Template Injection

15.3.7. Deny Rule Group – (default) HTML Injection in Parameter Value

15.3.8. Deny Rule Group – (default) HTML Injection in Header Value

15.3.9. Deny Rule Group – (default) HTML Injection in Path

15.3.10. Deny Rule Group – (default) UNIX Command Injection in Parameter Value

15.3.11. Deny Rule Group – (default) UNIX Command Injection in Header Value

15.3.12. Deny Rule Group – (default) Windows Command Injection in Parameter Value

15.3.13. Deny Rule Group – (default) Windows Command Injection in Header Value

15.3.14. Deny Rule Group – (default) LDAP Injection in Parameter Value

15.3.15. Deny Rule Group – (default) LDAP Injection in Header Value

15.3.16. Deny Rule Group – (default) PHP Injection in Parameter Value

15.3.17. Deny Rule Group – (default) PHP Injection in Header Value

15.3.18. Deny Rule Group – (default) Object Graph Navigation Library injection

15.3.19. Deny Rule Group – (default) Insecure Direct Object Reference in Parameter Value

15.3.20. Deny Rule Group – (default) Insecure Direct Object Reference in Path

15.3.21. Deny Rule Group - (default) NoSQL Injection in Parameter Name

15.3.22. Deny Rule Group - (default) NoSQL Injection in Parameter Value

15.3.23. Deny Rule Group - (default) NoSQL Injection in Header Value

15.3.24. Deny Rule Group – (default) Parameter Name Sanity

15.3.25. Deny Rule Group – (default) Parameter Value Sanity

15.3.26. Deny Rule Group – (default) Header Name Sanity

15.3.27. Deny Rule Group – (default) Header Value Sanity

15.3.28. Deny Rule Group – (default) Path Sanity

15.3.29. Deny Rule Group – (default) Encoding and Conversion Exploits in Parameter Value

15.3.30. Deny Rule Group – (default) Encoding and Conversion Exploits in Header Value

15.3.31. Deny Rule Group – (default) HTTP Response Splitting

15.3.32. Deny Rule Group – (default) HTTP Parameter Pollution

15.3.33. Deny Rule Group – (default) Automated Scanning

15.4. Default request actions reference list

15.5. Default response actions reference list

15.6. Environment cookies

15.7. Rewrite variables

15.8. YAML – Basics page

15.9. Regular Expressions - Basics page

15.10. Regular Expressions - Experts Page

15.11. Cookie security attributes

15.12. Supported SSL/TLS versions

15.13. Reference lists of log messages

15.13.1. Log Fields

15.13.2. Request Summary

15.13.3. Block Summary

15.13.4. Reject Summary

15.13.5. Back messages

15.13.6. Session Start and End Messages

15.14. Where to find 3rd-party licenses

15.15. Reference lists of supported JWKS algorithms