2.8.2.1 Access Compliance Studio Application when Gateway is Enabled

This section describes how to access the Compliance Studio application when Gateway is enabled.

The Compliance Studio Gateway serves as the central routing point for accessing the UI, ensuring a consistent origin for the Compliance Studio UIs. The introduction of the gateway addresses the security risks and inconsistencies by centralizing access and enhancing security.

This implementation, achieved via Spring Cloud Gateway, consolidates all UI access through a single port. By doing so, the gateway enforces security headers to mitigate clickjacking vulnerabilities. Specifically, it sets the Content Security Policy (CSP) with the frame-ancestors 'self' directive, ensuring that the UI can only be embedded within the same origin.

By default, COMPLIANCE_STUDIO_GATEWAY_ENABLED is set to true and COMPLIANCE_STUDIO_GATEWAY_PORT is 7071 in the <COMPLIANCE_STUDIO_INSTALLATION_PATH>/bin/install.sh directory.

Note:

Make sure that COMPLIANCE_STUDIO_GATEWAY_PORT and Datastudio default port should be opened in the firewall.

The Compliance Studio URL when gateway is enabled should be https://<Hostname>:<COMPLIANCE_STUDIO_GATEWAY_PORT>/cs/home.

Configure SAML Authentication

Note:

This section is applicable only when AUTH_REALM is SAML.

To configure the SAML Authentication:

1. Navigate to the following directories:
   <COMPLIANCE_STUDIO_INSTALLATION_PATH>/deployed/mmg-home/mmg-ui/conf
   <COMPLIANCE_STUDIO_INSTALLATION_PATH>/mmg-home/mmg-ui/conf
2. Open the application.properties file and update port number in the following parameters:
   saml.auth.sp.entity=https://<Hostname>:<COMPLIANCE_STUDIO_GATEWAY_PORT>/cs
   saml.auth.consumerserviceurl=https:// <Hostname>:<COMPLIANCE_STUDIO_GATEWAY_PORT>/cs/home

   For example:

   saml.auth.sp.entity=https://<Hostname>:7071/cs

   saml.auth.consumerserviceurl=https://<Hostname>:7071/cs/home

3. In IDCS configurations for Compliance Studio UI, update the Assertion consumer URL as https://<Hostname>:<COMPLIANCE_STUDIO_GATEWAY_PORT>/cs/home.

   For example:

   Assertion consumer URL: https://<Hostname>:7071/cs/home

   Note:

   For Data Studio UI, keep the existing configuration as it is.
4. Restart the Compliance Studio services.
   After restart, the Compliance Studio URL will be https:// <Hostname>:<COMPLIANCE_STUDIO_GATEWAY_PORT>/cs/home.