Is there any way to login with JWT token and username?

khanhcongle

Hi Ivy team,

I check in source code, to login an Ivy session we need to provide passwords as:

ch.ivyteam.ivy.security.internal.Session.authenticateSessionUser(String userName, Password password)

But when I click on login link, somehow I don't need to provide password:

So I think there is a way, could you help?
Best regards,
Khanh

mhoffmann

That's because you're using the Designer, which is obviously focused on developing and therefore lets you choose any of the defined test users from the login dialog without having to enter a password.

Since JWT are most likely issued by some sort of IDM (e.g. Keycloak), you want to basically implement SSO with them, which is a documented process (at least with Axon Ivy 10).

Since it looks like an Axon Ivy 8 designer to me, I'd also urge you to update to 10 in order to more up to date, if possible.

For Axon Ivy 8, this process was described here.

khanhcongle

Hi @mhoffmann

Thanks for your suggestions. We already proposed the Axon Ivy 10 to higher manager.

Currently, we are using Axon Ivy 7, and a very standard reverse proxy (Nginx) in front of Ivy Engine. I see there might be security risk as specified in the document (https://developer.axonivy.com/doc/7.4/engine-guide/integration/web-application-firewall.html):

If you activate this Valve you must ensure that the Axon.ivy Engine cannot be accessed directly. All traffic must be routed over the WAF.
Otherwise, an attacker could simple send a valid user name as header in a HTTP request and immediately has access bypassing the authentication!

I would be grateful if you could clarify the feasibility of using Nginx and a self-hosted WAF solution for WAF functionality.

Specifically, are there any documented guidelines or best practices for integrating Nginx with a third-party WAF module to secure Axon Ivy deployments?

Thank you for your time and assistance.

mhoffmann

khanhcongle

You're welcome!

I must admit that my knowledge of Axon Ivy 7 is pretty limited and rather vague after not having worked with it for some years, but the situation you cited still applies for Axon Ivy 10.

In the end, the engine reads the user from the header provided by your WAF.

The engine works as follows:

1) Read the user from the header
2) Look it up in the Security System - if it finds a match, you're authenticated.

That just means that if you are to access the engine directly (usually HTTP / HTTPS), you can just fake the header and authenticate as every user you like by modifying the header.

So you need to ensure that every traffic to Axon Ivy is coming through your proxy and never accessing the engine directly. The engine ports should be limited to accept only traffic from the WAF which requires the user to be authenticated.

khanhcongle

Hi @mhoffmann ,

Thank you for your insights into the Axon Ivy. I appreciate you taking the time to explain the process and potential security concerns. We will ensure that all traffic to the engine is routed through the WAF and necessary port restrictions are implemented.

Thanks again for your help.