OAM - Preferred HTTP Host vs Host Identifiers

Question

Hi all,
I think I am missing something regarding Preferred HTTP Hosts and Host Identifiers. This is what the documentation says about them:
"The Access System offers two methods for identifying Web servers that are hosting protected resources:
* Preferred Host
* Host Identifiers
You can specify either a Preferred Host or a Host Identifier"
However, regarding the Preferred HTTP Host, it also says it is a required field when configuring a WebGate and that the Preferred HTTP Host must be one of the entered in the Host Identifier List.
So I guess that when one intends to use Host Identifiers, the preferred host identifier must be defined as well, but somehow it will be ignored and the Host Identifier will be used instead?
Any help would be greatly appreciated.
Thanks

Answer 1

Regarding the 'required' field - this is a bug (maybe someone will come out of the wood work and disagree with me?) - what version of the product are you working with?
The theory goes like this: Host Identifiers are the line between the real world network and the inner workings of the product. If you want OAM to deliver AAA services, then you have to successfully cross this line. You successfully cross this line by issuing a HTTP request with a host component that matches one of the values in a Host Identifier's Host Name Variations list (If you want to avoid OAM AAA Services, you deliberately avoid this matching). One thing to be clear about - Host Identifiers are not optional if you are protecting HTTP resources. They are required.
Clearly, there is a security concern at play based on this thinking. What if you forget to add an addressable pattern to the variations list and someone walks around your security by IP address or localhost, for example? Preferred HTTP Host instructs the WebGate plugin to explicitly set the host component of every request to the value specified. Usually you intend this to match a value in the Host Name Variations list and your worries are gone.
There are some web architectures using virtual hosting where you deliberately do not want to mutate all host values into the same string - that's why this field should not be required.
The way to manage security risk when not using the Preferred HTTP Host is to combine the use of Host Name Variation values with the Deny On Not Protected flag on the WebGate. This way, the system will only allow traffic that you have specifically configured to be exposed.
Hope that all makes sense and helps somewhat.
Mark