OAM- Power User

Question

I am trying to implement power user use case in OAM.
1> Landing login page accepts the used id and verifies that user exists in oam under group Admin. I am using credential mapping plug-in with a filter for the group Admin. Security level for landing page authentication scheme is 1
2> On authentication success, I am setting the headervar powerid=samaccountname and redirecting the user to form login. Security level for landing page authentication scheme is 2.
3> On authentication failure, I am setting the headervar powerid=samaccountname and redirecting the user to secure id login. Security level for landing page authentication scheme is 2
I need to automatically pre fill the user id on form login and secure id login pages by reading the header variable that was set on authentication success/failure in step 2 and 3.
Redirection is working fine after authentication failure and success. But I don't see the headervar in my login pages. I am seeing the headervar being set in access debug log. My login pages are developed in perl. I tried to print all header variables on my login page but I still don't see them.
I was told that when we redirect from authentication success/failure, headervar gets dropped by webgate. So I don't see them. Same thing happens even if I try to use the authorization success/failure. I wanted to know how do I implement this use case? All I want to do is pre fill the user id on the login page by reading it from headervar.
Prasad

Answer 1

The product will not perform both redirect and setHeader in the same action set (within the same rule) (it is considered a security risk).
The usual approach, then, is to perform the redirect in one action and set the header in another rule (perhaps on the receiving authorization rule of the redirect target).
I might approach this by setting your headers on the authorization action for the landing page (which must be a protected resource) following the first credential mapping operation. That landing page probably has no visible UI but I would set a cookie there with samaccountname. That cookie will easily persist until you make your request that invokes the next form authentication scheme. That login form can populate the powerid based on the cookie.
If you have needs around the retaining the originally requested resource, try using passthrough:yes and grabbing it from a header and also converting it to a cookie for short term retention.
I hope that helps.
Cheers,
Mark