Merge pull request #1 from IBM-Security/v20.01

IAG v20.01 release updates.

Author: scottexton

openapi/ci_oidc.yaml

@@ -62,24 +62,25 @@ ci_oidc:
     match a configured rule it will by default be added to the
     credential.
 
-    Example: ci_oidc:
-                 hostname: www.test.com
-                 client_id: 11111111-2222-3333-4444-5a5a5a5a5a5a5a
-                 client_secret: 1a2b3c4d5e
-                 mapped_identity: "{sub}"
-                 redirect_uri_host: www.test2.com
-                 response_type: code
-                 response_mode: query
-                 proxy: https://www.testproxy.com:443
-                 scopes: 
-                     - profile
-                     - email
-                 allowed_query_args: 
-                     - "oidc_test=value"
-                 bearer_token_attrs: 
-                     - "-access_token"
-                 id_token_attrs: 
-                     - "-email"
+    Example: identity:
+                 ci_oidc:
+                     hostname: www.test.com
+                     client_id: 11111111-2222-3333-4444-5a5a5a5a5a5a5a
+                     client_secret: 1a2b3c4d5e
+                     mapped_identity: "{sub}"
+                     redirect_uri_host: www.test2.com
+                     response_type: code
+                     response_mode: query
+                     proxy: https://www.testproxy.com:443
+                     scopes: 
+                         - profile
+                         - email
+                     allowed_query_args: 
+                         - "oidc_test=value"
+                     bearer_token_attrs: 
+                         - "-access_token"
+                     id_token_attrs: 
+                         - "-email"
 
   type: object
   properties:

openapi/logging.yaml

@@ -16,14 +16,18 @@ logging:
         A boolean which indicates whether the logging will be
         in JSON format or not. If not specified logging will not be
         in JSON format.
-        Example: json_logging: true
+        Example: logging:
+                     json_logging: true
       type: boolean
       default: false
 
     components:
       description: >
         Specifies an array of auditing components to be enabled.
-        Example: components: ["audit.authn", "audit.azn"]
+        Example: logging:
+                     components: 
+                         - audit.authn
+                         - audit.azn
       type: array 
       items:
         type: string
@@ -77,7 +81,7 @@ logging:
         Example: logging:
                      request_log:
                          file:
-                             file_name: /var/iag/logs/request.log
+                             file_name: request.log
                          format: "%t %a %R"
       type: object
       properties:
@@ -90,7 +94,11 @@ logging:
           properties:
             file_name:
               description: >
-                The full path name of the generated log file. 
+                The name of the generated log file.  If the file name 
+                is supplied without any path information the file will be
+                written to the '/var/iag/logs' directory.  If the file name
+                contains path information the hosting directory must be created
+                and available before the container is started.
               type: string
             max_file_size:
               description: >
@@ -130,18 +138,22 @@ logging:
         the environment.
         Example: logging:
                      tracing:
-                         - file_name: /var/iag/logs/http_trans.log
+                         - file_name: http_trans.log
                            component: pdweb.http.transformation
                            level: 9
-                         - file_name: /var/iag/logs/http.log
+                         - file_name: http.log
                            component: pdweb.http
                            level: 5
       items:
         type: object
         properties:
           file_name:
             description: >
-              The full path name of the generated log file.
+              The name of the generated log file.  If the file name 
+              is supplied without any path information the file will be
+              written to the '/var/iag/logs' directory.  If the file name
+              contains path information the hosting directory must be created
+              and available before the container is started.
             type: string
           component:
             description: >
@@ -164,15 +176,19 @@ logging:
         environment.
         Example: logging:
                      transaction:
-                         file_name: /var/iag/logs/trans.log
+                         file_name: trans.log
                          max_file_size: 1024
                          max_files: 5
                          compress: true
       type: object
       properties:
         file_name:
           description: >
-            The full path name of the generated log file.
+            The name of the generated log file.  If the file name is supplied 
+            without any path information the file will be written to the 
+            '/var/iag/logs' directory.  If the file name contains path 
+            information the hosting directory must be created and available 
+            before the container is started.
           type: string
         max_file_size:
           description: >
@@ -200,50 +216,50 @@ logging:
 
     statistics:
       description: >
-        Specifies an array of statistic gathering components to be enabled.
-        Statistics can be used to assist with problem determination in
-        the environment.
+        Configures the statistic collection and publishing capability for the
+        gateway.  The statistics for the configured components will be 
+        published to the specified statsd server over UDP.  Statistics can be 
+        used to monitor the environment, or assist with problem determination 
+        in the environment.
         Example: logging:
                      statistics:
-                         - file_name: /var/iag/logs/authn_stats.log
-                           component: pdweb.authn
-                           count: 20
-                           interval: 20
-                        - file_name: /var/iag/logs/http_stats.log
-                           component: pdweb.http
-                           count: 20
-                           interval: 20
-      type: array
-      items:
-        type: object
-        properties:
-          file_name:
-            description: >
-              The full path name of the generated log file.
-            type: string
-          component:
-            description: >
-              The name of the statistical component to be enabled. Refer to
-              the troubleshooting documentation for the full list of component names.
+                        server: 127.0.0.1
+                        port: 8125
+                        frequency: 20
+                        components:
+                          - iag.authn
+      type: object
+      properties:
+        server:
+          description: >
+            The server on which the statsd server is listening for requests.
+          type: string
+        port:
+          description: >
+            The port on which the statsd server is listening for requests.
+          type: number
+          default: 8125
+        frequency:
+          description: >
+            The frequency (in seconds) that statistics are sent from the
+            memory buffer to the statsd server. 
+          type: number
+          minimum: 1
+          maximum: unlimited
+        components:
+          type: array
+          description: >
+            Specifies an array of statistic components to be enabled.  Refer to
+            the troubleshooting documentation for a full description of the
+            available component names.
+          items:
             type: string
-          count:
-            description: >
-              The number of reports sent to the log file. After the count value is reached,
-              reporting to a log file stops. However, the statistic component is still enabled.
-              If the interval value is not set or is set to 0 the count will have no effect.
-              If the interval value is set and count is not set, statistics information will
-              be sent to the log file at the interval indefinitely.
-            type: number
-            minimum: 1
-            maximum: unlimited
-          interval:
-            description: >
-              The time interval (in seconds) when statistics are sent from the
-              memory buffer to the log file. If the interval is not set or is set to 0,
-              no statistics are sent to the log file. However, the statistic component is still enabled.
-              If interval is set and count value is not set, statistics information will
-              be sent to the log file at the interval indefinitely.
-            type: number
-            minimum: 0
-            maximum: unlimited
+          enum:
+            - iag.authn
+            - iag.http2
+            - iag.https
+            - iag.resource_server
+            - iag.sescache
+            - iag.threads
+            - iag.websocket
 

openapi/policies.yaml

@@ -82,6 +82,8 @@ policies:
                                      - "/alt/resource_1"
                                    method: GET
                                    rule: "@http_trans_rule.xsl"
+                                   attributes:
+                                     - AZN_CRED_PRINCIPAL_NAME
           type: array
           items:
             type: object
@@ -114,6 +116,16 @@ policies:
                 description: >
                   The HTTP transformation rule.
                 type: string
+              attributes:
+                description: >
+                  The credential attributes which will be included in the XML
+                  input document, used when evaluating the HTTP transformation
+                  rule.  The attributes will be stored in the 
+                  HTTPResponse/credential/attributes/attribute path of the 
+                  XML document.
+                type: array
+                items:
+                  type: string
 
     cors:
       description: |
@@ -260,7 +272,7 @@ policies:
 
         This entry is an array and can be used to define multiple policies.
         Example: policies:
-                     rate-limiting:
+                     rate_limiting:
                          - name: rate_policy_A
                            methods: 
                                - GET
@@ -344,14 +356,34 @@ policies:
             items:
               type: string
 
+          full_line_match:
+            description: >
+              Should the location match a full line, or should it match 
+              any string in the response?  When a full line match is configured
+              the content will be inserted prior to the matching line.  When a
+              partial line match is configured the content will be inserted 
+              immediately prior to the matching string.
+            type: boolean
+            default: true
+
           location:
             description: >
-              The location where the content should be injected. The
-              location is pattern matched against a line in the response
-              using the '*.' wildcard characters.  The maximum length of
-              a line which can be matched by this mechanism is 8192 bytes.
+              The location where the content should be injected. If a full
+              line match is being used the location is pattern matched against 
+              a line in the response using the '*.' wildcard characters.  The 
+              maximum length of a line which can be matched is 8192 bytes.
             type: string
 
+          replace_match:
+            description: >
+              If a partial line match is being used this configuration entry
+              will control whether the matching string is replaced with
+              the supplied content, or whether the supplied content is
+              inserted prior to the matching string.  This configuration
+              entry will be ignored if full line matches are being used.
+            type: boolean
+            default: false
+
           content:
             description: >
               The data which is to be injected.