 |
|
|
|
Cosign v3 provides an enhanced security architecture and stricter requirements for the configuration of filters. Since the production WebAccess login system was upgraded to v3 on 2009/07/07 (Alert 1151), you may use it to test your v3 Cosign filters.
It is recommended that you verify the proper operation of your test, non-production web site with the same version of the Cosign filter as you've been using, and then you can test upgrading that site to v3, and check your back-out procedures. Once you are satisfied with your site remaining at v3, contact us and request that we mark your test site as upgraded.
Support for v2 filters is not going away: v2 filters will be supported for the foreseeable future. The only date mentioned, August 18, only refers to requiring the CN, Service Name, and FQDN to match.
Details of new requirements are below, but in brief: For a Penn State site serving cosign-protected content, if there's any variance to the following, an exception must be added to the production WebAccess login system. Given a site www.example.psu.edu:
The stricter requirements in a fully-implemented v3 Cosign service require three elements to match on your protected site. Those elements are
For the WebAccess protected site www.example.psu.edu, the corresponding values would be
You can verify and correct the above on your sites today, in preparation for the upgrade.
When the production login systems are upgraded to v3, they will be run in a "relaxed" mode until Tuesday, August 18, 2009, which will allow mismatches among those elements. Older v2 filters will continue work after that date, provided that the values above do match, or an exception has been added to the WebAccess login system.
Also, note that DNS names and IP address mappings are not part of the checks. This means that a load-balanced WebAccess-protected web site, where two or more systems serve the same FQDN and use the same certificate and Cosign Service Name, will continue to work without any special requirements.
Should you have a configuration that doesn't fit the above model, you may request an exception, noting your FQDN(s), Cosign Service Name(s), and certificate CN(s). Some exceptions would be
On each protected site, the URL path /cosign/valid
is used by the Cosign filter and is reserved for it.
Should your site have a conflict with that, please contact us
to discuss the problem.
For the WebAccess protected (and encrypted) site www.example.psu.edu,
the full URL reserved by v3 would be
https://www.example.psu.edu/cosign/valid
If your site does not use SSL or uses a non-standard port number, this reserved URL would match that.
Since the production WebAccess system was upgraded to v3 on 2009/07/07 (Alert 1151), use of this test system is no longer needed to test your v3 Cosign filters.
To have your test site's non-V3 Cosign filter use the WebAccess test system,
save your current Cosign configuration,
and in it change all references of
webaccess.psu.edu
to
webaccess-test.ait.psu.edu
The WebAccess test system uses the same base of information as the production system: any currently registered CN should be able to use it. However, some slightly shorter values are in place for maximum session lifetime (9 hours) and idle time (30 minutes).
To help differentiate the test system from the production one, you'll notice that the large graphic is slightly different, as well the html page titles having the word "test" inserted.
Also, to minimize delays in your testing, the configuration of the WebAccess test system will be updated during the day as requests are received. Such restarts may cause very short outages (3-5 seconds) of the service, as only one server is active.
These instructions are in addition to the current documentation for installing filters, and are constructed for sites using secure browsing (https:); non-secure sites will be slightly different, and should ask us about the differences.
Copies of v3 filters are available from the Cosign site, on its "download" page (linked from the navigation area on the left side of the home page). The linked icons at the top of that page may not refer to the v3 version.
The regular expressions in the CosignValidReference
(or ValidReference) directives below must be adjusted if you
are using an IP address for the "FQDN" in your site's URL,
if your FQDN doesn't end in "psu.edu",
or if you're using a non-standard port number.
The expression is used by your Cosign filter to determine what URLs
are to be handled by it (are valid to it);
it can be made very specific.
CosignValidReference ^https?:\/\/.*\.psu\.edu(\/.*)?
CosignValidationErrorRedirect https://webaccess.psu.edu/validation_error.html
<Location /cosign/valid>
SetHandler cosign
CosignProtected Off
Allow from all
Satisfy any
</Location>
/var/cosign/filter .
NO EFFECT ON THOSE CURRENTLY CONNECTED: They will automatically be issued v3 service cookies and not experience any difficulties.
A v3 Cosign module for IIS 7 is now (2009-06-11) available. Until detailed instructions are available, use http://www.itcs.umich.edu/itcsdocs/s4364/ as a reference for changes, and the other filter sections in this document for the Penn State-specific adjustments.
<ValidReference>^https?:\/\/.*\.psu\.edu(\/.*)?</ValidReference> <ValidationErrorRedirect>https://webaccess.psu.edu/validation_error.html</ValidationErrorRedirect>
…\IISCosign\CookieDB) to invalidate existing service cookies.
NO EFFECT ON THOSE CURRENTLY CONNECTED: They will automatically be issued v3 service cookies and not experience any difficulties.
<RedirectToHttps>true</RedirectToHttps>
Until detailed instructions are available, use http://www.itcs.umich.edu/itcsdocs/s4364/ as a reference for changes, and the other filter sections in this document for the Penn State-specific adjustments.
This document based, in part, on http://www.itcs.umich.edu/itcsdocs/s4364/.