Environment
Access Manager 4.4
Access Manager 4.3
Admin Console
Azure or Amazon Web Services platforms
Situation
When an Admin Console iManager, running in an AWS or Azure cloud, is accessed via its public IP address some operations such as modifying a SAML 2 service provider are problematic.
For example, if an admin logs into their Admin COnsole iManager in an AWS/RHEL setup using the public IP assigned to the VM where the AC is running (ex: https://152.38.92.102:8443/nps), then go into the legacy SAML 2 UI and attempt to modify a setting on an existing SP, the browser will show "Waiting for <ip>" for two minutes before proceeding due to a socket timeout exception.
It appears that the AC always tries to connect to the /roma/rest/idpclusters/devices endpoint using the IP or DNS name that is used in the browser session instead of using its own, local ip.
For example, if an admin logs into their Admin COnsole iManager in an AWS/RHEL setup using the public IP assigned to the VM where the AC is running (ex: https://152.38.92.102:8443/nps), then go into the legacy SAML 2 UI and attempt to modify a setting on an existing SP, the browser will show "Waiting for <ip>" for two minutes before proceeding due to a socket timeout exception.
It appears that the AC always tries to connect to the /roma/rest/idpclusters/devices endpoint using the IP or DNS name that is used in the browser session instead of using its own, local ip.
Resolution
Defect logged with engineering but can workaround the issue with following steps:
1. Use a URL with a DNS name instead of IP address when accessing the AC (ex: https://acredhat.aws.netiq.com:8443/nps). Workstations should resolve this DNS name to the public IP address of the AC vm.
2. Make an entry in the AC's /etc/hosts file so that it resolves this same DNS name to its own *internal* IP address. For example:
10.10.20.10 acredhat.aws.netiq.com
1. Use a URL with a DNS name instead of IP address when accessing the AC (ex: https://acredhat.aws.netiq.com:8443/nps). Workstations should resolve this DNS name to the public IP address of the AC vm.
2. Make an entry in the AC's /etc/hosts file so that it resolves this same DNS name to its own *internal* IP address. For example:
10.10.20.10 acredhat.aws.netiq.com
Cause
The call to the rest endpoint should be sent to the vm's local ip, not the ip or dns name in the browser session used to access the AC