UEM requests being blocked by SiteMinder

Question

Question by Ben S. · Jan 24, 2015 at 04:19 AM ·

UEM requests being blocked by SiteMinder

We are using SiteMinder in our environment with the BadCSSChars setting turned on. This setting is for cross-site scripting attacks and blocks characters like <>'. This is causing thousands of User Action Visit requests to be blocked with a 403 error since a lot of the requests contain these characters. The SiteMinder team will not disable this setting due to security concerns. dynaTrace support provided a configuration property (spc) under UEM that is supposed to encode these characters, but Siteminder can detect these characters whether they are encoded or not. Below is an excerpt of how the requests come in (%7C and %3C are the forbidden characters).

a=d%7Ckeypress%20%3CRETURN%3E%20on%20%22claimno%22%7Ckeypress%20%3CRETURN%3E%7C147740757_6

Has anyone else encountered this issue? If so, have you found a workaround?

Thanks,

Ben

0

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Answer 1 · 2015-02-28T00:10:50Z

Answer by Mike T. · Feb 28, 2015 at 12:10 AM

Hi Ben

Can I ask what version of Dynatrace you are using?

Thanks

Mike

0 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Answer 2 · 2015-01-26T22:15:06Z

Answer by Andreas G. · Jan 26, 2015 at 10:15 PM

Great suggestion from Sreerag.

Another thought that comes to my mind is that you can setup a seprate Web Server, e.g: Apache - which you just use to collect the Monitoring Signal.

Andi

0 Show 1 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Ben S. · Jan 31, 2015 at 02:35 AM 0

Share

Andi, where can I find documentation on the setup you are suggesting? Also, do you know if there are any plans for a workaround? I was told by support to submit an enhancement request.

Thanks,

Ben

Answer 3 · 2015-01-25T14:10:32Z

Answer by Sreerag M. · Jan 25, 2015 at 02:10 PM

Hi Ben,

We have not faced such situation. My guess is that you need the DT agent intercept the /dynatraceMonitor requests before the siteminder.

May we know the technology used by the web servers? The basic idea would be to change the priority of the DT agent higher than siteminder agent so the DT agent can intercept the request before SM agent.

-Sreerag

0 Show 3 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Ben S. · Jan 27, 2015 at 01:52 AM 0

Share

Hi Sreerag,

We are using IBM HTTP Servers.

Ben

Sreerag M. Ben S. · Jan 28, 2015 at 03:44 AM 0

Share

We also do have siteminder; when i checked our httpd.conf i found that we are loading the siteminder module at the very end.

I think this explains why we never faced this issue.

-Sreerag

Ben S. Sreerag M. · Jan 31, 2015 at 02:31 AM 0

Share

We tried placing the Siteminder module further below the dynaTrace webserver module in the httpd.conf file, but that didn't seem to help. We actually didn't realize we had this problem until we began using Splunk to monitor our webserver logs. The 403 errors don't appear in dynaTrace either.

UEM requests being blocked by SiteMinder

3 Replies

Join the conversation!

NAM 2019 SP3 is available

LIVE WEBINAR

Follow this Question

Forum Tags