Integrating Unblu with the Airlock Web Application Firewall (WAF) with protected resources
The Airlock Web Application Firewall (WAF) is one of the reverse proxy products expressly supported by Unblu for securing public internet access to Unblu installations. This article describes how to configure an Airlock WAF that proxies your Unblu server to your public visitors.
There are three guides for configuring the Airlock WAF. Go through the checklist to choose the appropriate instructions for your use case before you start configuring the Airlock WAF. |
Before you start
Before you start, verify that your current installation meets the requirements to run Unblu with Airlock WAF.
-
For the Unblu server, complete the following steps:
-
Check that the
SYSTEM
path is enabled. The configuration property com.unblu.systementrypath.enabled must betrue
. -
Make a note of the values of the following configuration properties:
-
com.unblu.identifier.singleAccountSessionCookieName or com.unblu.identifier.multiAccountSessionCookieName, depending on whether you have multiple accounts set up on your Unblu server.
You need them when you configure the mapping for the Unblu server in the reverse proxy settings.
-
-
Open the Airlock administration interface and navigate to
. Make sure the version of Airlock WAF you’re using is 5.3 or higher. -
Check that:
-
ICAP is on.
-
Expiry is a date in the future.
Figure 1. Airlock license screen -
Configuring the Airlock WAF
Remember to click the Activate button once you’ve finished configuring the Airlock WAF. |
Configure the Unblu back-end group
-
In the left sidebar of the Airlock administration interface, navigate to
. -
Create the back-end group for the Unblu server if you haven’t already done so.
-
On the Basic tab, fill in the following details:
-
The Name of the group.
-
The appropriate Protocol.
-
The name of your Unblu server’s Back-end host.
-
The Port the Unblu server uses.
Figure 2. Airlock Unblu back-end group, Basic tab -
Configure the mapping for the Unblu server
Next, create the mapping for the Unblu server. Start with a new empty mapping. Give it a name that makes it clear which environment and version of Unblu it maps and work through the various tabs as outlined below.
The Basic tab
On the Basic tab, make the following changes:
-
In the Service and Mode section, set the Entry path and the Back-end path to the value of Unblu’s
PUBLIC
path prefix as defined in com.unblu.identifier.publicPathPrefix, followed by a trailing slash/
. -
In the Application section, set Session handling to Use available session.
-
Set Passthrough cookies to Use regular expression.
-
In the line below the radio button, add the values of the following configuration properties, separated by an OR (
|
):-
com.unblu.identifier.singleAccountSessionCookieName or com.unblu.identifier.multiAccountSessionCookieName, depending on whether you have multiple accounts set up on your Unblu server.
With the default values for the configuration properties listed above, the regular expression looks like this:
Listing 1. Regular expression for passthrough cookies with a single Unblu accountx-unblu-session | x-unblu-recorder-session | x-unblu-device | x-unblu-worker-origin | x-unblu-conversation-session
The default values for the configuration properties above contain variables. In the regular expression, you must replace the variable with its value, like in the example above. -
When you’ve finished, the Basic tab should look like this:
The Request Actions tab
On the Request Actions tab, complete the following steps:
-
Create a custom copy of the (default) Request header whitelist.
-
Adapt the name and add the following headers to the Header Name Pattern:
-
x-unblu-client
-
x-unblu-page
-
x-unblu-referer
-
x-unblu-xui
Separate the header names with an OR (
|
). -
-
Make sure you have an action that adds an
X-Forwarded-Proto
header to all requests. The action should look something like this:Request action to add or replace anX-Forwarded-Proto
header to requests -
Create an action that adds an
X-Forwarded-Host
header to all requests. The action should look similar to the one that adds anX-Forwarded-Proto
header.
The Response Actions tab
On the Response Actions tab, create a custom copy of the (default) Response header whitelist. Adapt the name and make sure that the Header Name Pattern includes the following headers:
-
Pragma
-
Cache-Control
-
Expires
-
x-unblu-xui
-
x-unblu-client
-
x-unblu-page
-
x-unblu-start-time
Add any missing headers to the pattern with an OR (|
).
Connect the Unblu mapping
When you’ve finished configuring the Unblu mapping, connect it to the virtual host and to the back-end group of the Unblu server.
Configure Airlock WAF to use the Unblu resource history
The steps below ensure that your agents see the same thing as your visitors in embedded co-browsing sessions.
Configure the ICAP network service
-
In the left sidebar of the Airlock administration interface, navigate to
. -
Add a new entry in the section ICAP Server - Antivirus, SOAP/XML filtering etc.
Figure 5. Airlock network services screen -
Give the new entry a name of your choice and enter the ICAP Service URL:
Listing 2. Airlock ICAP service URL for an Unblu account# ICAP service URL format https://<unblu-server-fqdn:port>/<system-path-prefix>/airlockicap/version-2/<api-key> (1) (2) (3) # Example https://unblu.yourcompany.com:12345/system/airlockicap/version-2/MZsy5sFESYqU7MawXZgR_w
1 Replace <unblu-server-fqdn:port>
with the fully qualified domain name and port of your Unblu server.2 Replace <system-path-prefix>
with the value of the configuration property com.unblu.identifier.systemPathPrefix.3 Replace <api-key>
with the Unblu API key you want to use.Choose a name for the ICAP service that makes it clear which Unblu account uses it. This makes it easier to select the right ICAP service when you configure the mapping for your application back-end.
Configure the mapping for the application back-end
To configure ICAP for the mapping of your Unblu-enabled application back-end:
-
In the left sidebar of the Airlock administration interface, navigate to
. -
In the main window, select the mapping from your virtual host to the application back-end and click its pencil icon to edit it.
-
Open the ICAP tab.
-
Create a new ICAP Response Client View:
-
Select the name of the ICAP Service you set up.
-
Enter
Cookie
as the Request Header Name Pattern. -
Enter the value of com.unblu.domcap.cookieName followed by an equals sign
=
as the Request Header Value Pattern. If you haven’t changed the default values for the cookie name and the cookie name prefix, the value to enter isx-unblu-recorder-session=
.You may need to add the name of the cookie specified in the configuration property com.unblu.conversationsession.cookieName to the pattern, too. (The default name is
x-unblu-conversation-session
) Before doing so, speak with a solution architect or solution integration engineer from Unblu to check whether this is required for your use case.
Figure 6. Airlock application back-end mapping, ICAP tab -
Configuring Unblu to use the Airlock WAF
Set the following configuration properties in the properties file of your Unblu server:
com.unblu.identifier.siteEmbeddedSetup=true
com.unblu.domcap.server.filter.airlock.enabled=true
com.unblu.domcap.server.filter.airlock.request.hostScheme=https (1)
1 | Set this configuration property to the scheme used by the backend application you provide embedded co-browsing for, such as e-banking. This is required by Unblu to construct the request URI, because the ICAP interface doesn’t provide this information. |
See also
-
For more information on the Airlock WAF, see the Airlock knowledge base and the Airlock machine sizing page.