How To: Enforce One Realm to Only Accept User Traffic from Another Realm

Version Affected: All versions

 

Overview

This article explains how to require end users to successfully authenticate through one SecureAuth Identity Provider (IdP) realm (the Starting realm) before they can reach a second realm (the Second realm), using Microsoft's IIS URL Rewrite tool. This is useful when the Second realm should only be reachable after an additional authentication step, or when the two realms use different user-group-access permissions or different datastore settings. The example screenshots below use a realm named SecureAuth25 as the Starting realm and a realm named SecureAuth24 as the Second realm — substitute your own realm names and URLs throughout.

Enforce the Realm Order

1. Configure the Starting realm as desired. From its Post Authentication tab, set Authenticated User Redirect to Use Custom Redirect, and in Redirect To, enter the Second realm's URL.

The screenshot below shows a realm's Post Authentication tab with Authenticated User Redirect set to Use Custom Redirect and Redirect To set to /secureauth24.

2. Configure the Second realm as desired. Optionally, from its Overview tab, set Restart Login URL to redirect back to the Starting realm.

The screenshot below shows the SecureAuth24 realm selected in the realm list, with its Restart Login URL field under Links set to /secureauth25.

3. Install Microsoft's URL Rewrite IIS tool if you haven't already. Open Internet Information Services (IIS) Manager, expand the directory under your machine's name, expand Sites and Default Web Site, and click the Second realm (for example, SecureAuth24). Double-click URL Rewrite.

4. From the Actions panel on the right, click Add Rule(s)..., select Blank rule under Inbound rules, and click OK. Name the rule, under Using select Wildcards, and under Pattern enter *. From the Action type drop-down, select Redirect and enter the Starting realm's URL.
5. Expand Conditions and click Add. Set Condition input to {HTTP_REFERER}, Check if input string to Does Not Match the Pattern, and Pattern to the Starting realm's URL with a wildcard at the end, then click OK. This condition redirects traffic back to the Starting realm if a user reaches the Second realm's URL without first authenticating through the Starting realm.

The screenshot below shows this condition's Edit Condition dialog, with Pattern set to https://YourWebsite.com/secureauth25/* — the Starting realm's URL in this example.

6. Expand Conditions and click Add again. Use the same Condition input and check type, but this time set Pattern to the Second realm's URL with a wildcard at the end, then click OK. This condition prevents already-authenticated traffic from being redirected back to the Starting realm as it moves through the Second realm's authentication and post-authentication workflow.

The screenshot below shows this second condition's Edit Condition dialog, with Pattern set to https://YourWebsite.com/secureauth24/* — the Second realm's URL in this example.

7. From the Actions panel, click Apply to save the rule.

The screenshot below shows the completed Edit Inbound Rule screen, with the Match URL pattern set to *, both HTTP_REFERER conditions listed under Match All, the Action type set to Redirect back to the Starting realm, and Apply highlighted in the Actions panel.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.