Sun OpenSSO Enterprise Policy Agent 3.0 Guide for Microsoft Internet Information Services (IIS) 6.0

Ignoring the Path for Not Enforced URLs (Optional)

The property indicates whether the path information and query should be removed from the request URL before it is compared with not-enforced URLs, when those URLs have a wildcard (*) character.

For security reasons, this property should be set to true, to avoid certain situations. For example, if a not-enforced URL such as http://host/*.gif exists, someone can access http://host/index.html by using the request URL http://host/index.html/hack.gif.

The default value for is true. If necessary, you can set is property in the OpenSSO Console.

ProcedureTo Ignore the Path for Not Enforced URLs

  1. Login to the OpenSSO Console as amadmin.

  2. Click Access Control, realm-name, Agents, and then the profile name for the IIS 6.0 agent.

  3. Click Advanced.

  4. Scroll down to Custom Properties and add the following property:

  5. Click Save.