Known Issues

Policy Manager

https://<Gateway Hostname>:8443/restman/1.0/listenPorts GET

<l7:EnabledFeatures>
   <l7:StringValue>Published service message input</l7:StringValue>
   <l7:StringValue>Administrative access</l7:StringValue>
   <l7:StringValue>Browser-based administration</l7:StringValue>
   <l7:StringValue>Built-in services</l7:StringValue>
</l7:EnabledFeatures>

<l7:StringValue>Browser-based administration</l7:StringValue>

Create a new security zone . Two new roles will become available:

View X Zone
Manage X Zone

Assign all the entities which should be available for a group of users (for example, developers) to this security zone.

Do one of the following:

Only assign View/Manage X Zone roles to the user role.
Create a new group, assign View/Manage X Zone roles as well as other necessary predefined roles to this group. Only assign this new group to the user role.

Disable auto-assign roles by setting these cluster-wide properties, to ensure the number of roles for a user does not automatically increase:

rbac.autoRole.managePolicy.autoAssign=false 
rbac.autoRole.manageProvider.autoAssign=false 
rbac.autoRole.manageService.autoAssign=false 

Integrations and Cloud

Backup your Azure MySQL database.

In privileged shell, enter the following command:

/opt/SecureSpan/JDK/bin/java -jar /opt/SecureSpan/Gateway/runtime/lib/liquibase-#.#.#.jar --driver=com.mysql.jdbc.Driver  --classpath=/opt/SecureSpan/Gateway/runtime/lib/mysql-connector-java-#.#.##.jar --changeLogFile=/opt/SecureSpan/Gateway/config/etc/db/ssg.xml --url=jdbc:mysql://gatewaydb.mysql.database.azure.com:3306/ssgvortx --username='vadmin@gatewaydb' --password='x' update

If you are using liquibase-4.#.# or a newer, ensure that the forward slash is added to the classpath parameter:
--classpath=/opt/SecureSpan/Gateway/runtime/lib/mysql-connector-java-#.#.##.jar:
/
See next section to learn which versions of the Liquibase (liquibase-#.#.#.jar) and MySQL connector drivers (mysql-connector-java-#.#.##.jar) you should use.

A 'Liquibase Update Successful' message should be returned.

To confirm that the Gateway version has been upgraded to 10.1, enter the following in MySQL:

select * from ssg_version 

For example, if version 10.1.00 is not returned for current_version, then enter the following:

update ssg_version set current_version = '10.1.00';

Database

Migration failed for change set upgrade_x.y.z.xml::create_published_service_properties::gateway:
Reason: liquibase.exception.DatabaseException: Error executing SQL CREATE TABLE ssg_testUpgrade.published_service_property (published_service_goid BINARY(16) NOT NULL, name VARCHAR(128) NOT NULL, value MEDIUMTEXT NOT NULL): Table 'published_service_property' already exists

# use ssg;
# select count(*) from DATABASECHANGELOG;

Encryption

Retrieve or download the certificate file using external means. For example, you can use this OpenSSL command:
# echo | openssl s_client -connect host.host:port 2>/dev/null | openssl x509 -outform PEM > cert.pem
Import the certificate to the Gateway by navigating to
Tasks > Certificates, Keys, and Secrets > Manage Certificates > Add > Import from a file

Assertion Operations

Set Context Variable fave as String to: banana
Set Context Variable fruits as String to: apple,banana,pear,banana
Split variable fruits into fruitsalad on ","
Look Up Item by Value: find item ${fave} within ${fruitsalad}; output index to ${index}
Return Template Response to Requestor -- ${index}

Download the .xml file to your computer.
Click
Import Policy
on the Policy Tool Bar to import the policy into the Policy Manager. For more information, see Importing a Policy from a File .

In the [Security] tab, the Service Authentication is “Use HTTP Credentials from Request”.
The backend services return a 401 HTTP error. (DE215522)

XML Canonicalization Has Changed for Gateway 10.1 CR2: Absolute Namespace URIs Must Be Used

Issue

: Some Gateway users who have published a web service containing Canonical XML transformation may experience the following error when a client attempts to make a request with XML within the body:

org.apache.xml.security.c14n.CanonicalizationException: Element <element name> has a relative namespace: ...

Because Gateway 10.1 CR2 was given a more secure XML messaging Java library upgrade, moving forward and following current XML messaging standards (see W3C Canonical XML Version 1.1 ), the use of relative namespace URIs for XML canonicalization has been removed. (DE545801)

Resolution

To resolve this, users must use an absolute namespace URI instead when accessing the

requestXpath.element

variable that results from specifying XPaths for assertions such as ' Evaluate Request XPath '.

For example, instead of using a relative URI such as

alpha/beta/charlieservice

, use the absolute URI,

http://delta.org/alpha/beta/charlieservice

, instead.

Other result variables like

requestXpath.result

and

requestXpath.elements

(plural) are strings and don't cause this error (i.e. does not use XML canonicalizer).

Workarounds

These workaround options apply if you are not immediately able to adopt the use of absolute namespace URIs for Gateway requests. Choose the one that works for your scenario.

[Workaround Option A]

Use the ' Evaluate Regular Expression ' assertion to extract the problematic element. For example, the following regular expression is used to extract the 'HeaderData' element:

<HeaderData(.*)<\/HeaderData>

See the Regular Expression Properties screenshot for reference.

[Workaround Option B]

If possible, use the

requestXpath.elements

(plural) result variable instead; however, this may return more than one matching result depending on your expected request data.

WARNING 1 com.l7tech.server.policy.PolicyCacheImpl: 3255: Policy "Google Auth Code Extension" (#d095d9a4c56c975b34c64db5a6741dd0) contains an unlicensed assertion: Unknown assertion: RetrieveOAuth2Token

<l7:Mapping action="NewOrExisting" srcId="
<unique_ID>" srcUri="http://
<IP_address>:8080/restman/1.0/firewallRules/
<identifier>" type="FIREWALL_RULE"/>

<l7:Mapping action="NewOrExisting" srcId="
<unique_ID>" srcUri="http://
<IP_address>:8080/restman/1.0/firewallRules/
<identifier>" type="FIREWALL_RULE">
   <l7:Properties>
      <l7:Property key="
MapBy">
         <l7:StringValue>
name</l7:StringValue>
      </l7:Property>
   </l7:Properties>
</l7:Mapping>

Miscellaneous

Logger.java:765|SSLSocket duplex close failed (
"throwable" : {
  java.net.SocketException: Socket is closed
        at java.net.Socket.shutdownInput(Socket.java:1539)
        at com.l7tech.common.io.SocketWrapper.shutdownInput(Unknown Source)
        at sun.security.ssl.BaseSSLSocketImpl.shutdownInput(BaseSSLSocketImpl.java:218)
        at sun.security.ssl.SSLSocketImpl.shutdownInput(SSLSocketImpl.java:643)
        at sun.security.ssl.SSLSocketImpl.bruteForceCloseInput(SSLSocketImpl.java:598)
        at sun.security.ssl.SSLSocketImpl.duplexCloseOutput(SSLSocketImpl.java:558)
        at sun.security.ssl.SSLSocketImpl.close(SSLSocketImpl.java:471)
        at com.l7tech.common.io.SSLSocketWrapper.close(Unknown Source)
        at com.l7tech.server.tomcat.c.close(Unknown Source)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:329)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:748)}
        

The value for context variable ${service.AAA} set in a global policy can be retrieved from the service policy. The expected result is that the variable is empty when access from the service policy.
The value for context variable ${service.BBB} set in the underlying policy fragment for an encapsulated assertion can be retrieved from the service policy. Assuming the variable is not configured to be returned as a parameter, the variable should be empty when accessed from the service policy.

com.l7tech.server.policy.assertion.ServerJmsRoutingAssertion: 4: Error in outbound JMS request processing: Something already bound at (queue-name). Exception caught!