Using IPs in Policy Agent fqdnMap puts agent/AM into loop

Question

We are running Access Manager (AM) 2005Q1 on Solaris. Our web servers protecting the content are Apache 1.3.29 with Policy Agent (PA) 2.1.
Our environment uses multiple web server instances on the same physical Apache web server. The separate instances are either assigned different ports so they are accessible via the web_server_IP:port or separate instance IPs so they are accessible via instance_IP:80. We do not have separate DNs names assigned for each web server instance.
For discussion purposes the web server host name is ws1.xyz.com and its IP is 10.1.1.1. The default web server is 10.1.1.1:80. Our 2nd web server instance is accessible via 10.1.1.1:81.
If we try to access the 2nd instance via http://10.1.1.1:81/myapp the default action of PA is redirect the browser to http://ws1.xyz.com:81/myapp. Due to special logic in some of our apps the PA redirect breaks the application (it�s a long story).
On separate tests I put the 2nd web server�s IP in the PA fqdnMap property as �valid|10.1.1.1� and �10.1.1.1|10.1.1.1� in order to try and prevent the initial PA redirect back to ws1.xyz.com:81. The user is properly directed to AM for authentication, however, after authentication there is a loop condition between PA and AM. My assumption is the loop is occurring because of a conflict between the IP used to access the web server and the cookie generated by AM. AM generates the cookie for the domain xyz.com. When the user is redirected back to http://10.1.1.1:81/myapp PA does not see a valid cookie and redirects the user back to AM. AM sees a valid cookie and redirects the user back to http://10.1.1.1:81/myapp hence the loop.
My questions are:
1. Does PA 2.1 support using IPs to access a web server instances?
2. If so, how do I configure this capability?
3. Would assigning separate IPs to each web server instance help? I assume assigning separate DNS to each instance would resolve the issue.
4. Is there something I need to do on AM to allow using IPs in the manner described?

Answer 1

this would only help if Access Manager and the policy agent receide on the same box.
Agent redirects to an FQDN to get the SSO Token. By default it�s a domain cookie and the browser will only set it to FQDN which are "below" that DNS domain.
To use IP-Addresses for the agent agent must use host-based cookies.
Configure agent for CDSSO and specify the ip address in the fqdnMap (as you already did) - or if Agent 2.2 is used disabled FQDN checking.
-Bernhard