Building a web blocking profile for problem urls
In the ISAM ESSO 8.2 Troubleshooting and Support Guide it documents a known issue with IE 7 & 8 hanging on some web site. But how can I identify the urls I need to specifiy if they are embedded within the main web site I'm accessing ?
The following outlines an approach that can be used to identify the site or URLs that you want to be handled by a 'dummy' profile, i.e. a profile that does nothing, but avoids the auto learn web profile from be loaded.
The main problem in this is identifying the URLs to add to our profile or URLs to ignored. Though it could be the main URL in the browser address bar, it could also be one of the embedded/hidden URLs that the main page loads, either immediately or in repeated periods
The URLs that the observer can see and therefore for which it will load the auto learn profile if there is not another matching profile defined can be identified by the methods outlined below.
- Ensure you have level 4 log level for the observer defined in the registry. (This is common for 8.1)
- Start AccessStudio and create an empty advanced profile, with only start node.
- Clear out all logs from the AccessAgent log directory, so only aa_observer.log (locked) remains.
- Note that if Internet Explorer only hangs after clicking on a link, then clear the logs just before clicking on the link to reduce the 'noise' in the logs.
- Identifying the URLs:
A) Use the logviewer utility application provide for TAM ESSO log files.
- Utility to view and partly analyse AccessAgent logs files has been made available on the IBM site. http://www.ibm.com/software/brandcatalog/ismlibrary/details?catalog.label=1TW10AMBZ
- This version has a log definition file that was designed for version 8.0 and the log formats have changed in 8.1 and again in 8.2, so these are not recognized by Log Viewer.
- Updated exe is available via this tech note:
- New log definition files are available for use with 8.1 and 8.2 via this tech note: http://www.ibm.com/support/docview.wss?uid=swg21610820
- Start the logviewer.
- File -> Open Log Files
- Set the 'Load Log Descriptor' to use the 'LogDesc81.xml'
- Use the 'Add Log Files' to add your current aa_observer.log, if other observer logs are generated, then include these.
- Once these have loaded, then on the left side in the 'Match Results' panel, expand the 'A new document got loaded'. This will show the URLs that have been seen.
B) Use a normal Text Editor.
- Load the aa_observer.log file(s)
- Look for lines like this:
[CEnBrowserListener::DocumentComplete] Analyzing document URL is <url>
- Make a list of the URLs defined by these lines.
- Once you have identified a URL, then you can add it in 1 or 2 formats, which one you will use will depend on the URL and whether you may want to store credentials for other pages in the URL's domain, e.g.
- /child::web[@domain="videos.lesechos.fr"] - all URLs for this domain are handled by the profile.
- /child::web[@url#"http.*facebook.com.*"] - only URLs which match the regular expression are handled by the profile.
- Then save and test the updated profile to see if Internet Explorer still hangs.
- Check each of the URLs seen until the hang is no longer happening.
The attached file contains the current auto learn profile and a profile for ignoring some URLs.
This can be used as a development package. i.e. add to the profile_web_urls_to_ignore the URLs you want to be ignored and test to see if the issue with Internet Explorer is handled or not.
More support for:
IBM Security Access Manager for Enterprise Single Sign-On
Software version: 8.1, 8.2, 8.2.1, 8.2.2
Operating system(s): Windows
Software edition: All Editions
Reference #: 1613564
Modified date: 19 November 2012