Home Knowledge Base SecureW2 Documentation Generic HTTP External Automation with SecureW2

Generic HTTP External Automation with SecureW2

Introduction

Generic HTTP sends real-time JoinNow events to an HTTP endpoint you define. Use it when SecureW2 doesn’t natively support your infrastructure.

Generic HTTP supports two event categories:

  1. Next Generation Firewall: Sends RADIUS accounting events (login and logout) to your firewall.
  2. Certificate Events: Sends certificate events (issuance and revocation) to your external server.

This document explains how to configure Generic HTTP to forward RADIUS accounting events to your firewall and certificate events to your external server.

Prerequisites

The following are the prerequisites for configuring Generic HTTP:

  1. An account in the JoinNow Management Portal with Autonomous Security Operations (ASO) – External Actions subscriptions.
  2. To forward RADIUS events to your custom endpoint, configure port forwarding on your ISP router.
  3. Port forwarding is configured to send certificate events to an external server.

Configuring JoinNow Management Portal

To set up Generic HTTP via the JoinNow Management Portal, configure the following sections:

  1. Configuring Next Generation Firewall
  2. Configuring Certificate Events

Configuring Next-Generation Firewall

A Next-Generation Firewall automation forwards RADIUS accounting events (Login and Logout) from JoinNow to your firewall, where they can be used to apply enforcement policies.

To create a Generic HTTP External Automation for your firewall, perform the following steps:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Integration Hub > Adaptive Defense External Automations.
  3. Click Add External Automation.
  4. In the Basic section, enter the name of the adaptive defense external automation in the Name field.
  5. In the Description field, enter a description for the adaptive defense external automation.
  6. From the Type drop-down list, select Generic HTTP under Next Generation Firewall.
  7. Click Save.
  8. Click the Configuration tab.
  9. In the Server URL field, enter the firewall URL to which RADIUS accounting events must be pushed.
  10. (Optional) To use your organization’s certificate, select the Custom SSL checkbox.
    1. In the Certificate field, click Choose File.
    2. Select the required certificate and click Upload.
  11. Select the Authentication checkbox.
  12. From the Authentication Method drop-down list, select any one of the following options:
    1. Basic
    2. OAuth 
    3. API Key
  13. If you select Basic as the authentication method:
    1. In the Username and Password fields, enter the credentials configured on the firewall server. JoinNow uses these credentials to authenticate when forwarding events.
    2. If you select OAuth as the authentication method:
      1. In the Token URL field, enter the OAuth authentication server URL.
      2. In the Client ID field, enter the Client ID provided by the OAuth server.
      3. In the Client Secret field, enter the client secret provided by the OAuth server.
      4. From the Token Authentication Method drop-down list, select Basic or Request Body.
      5. In the Scope field, enter the required scope.
      6. In the Body section, click Add and enter the required key-value pairs.
    3. If you select API Key as the authentication method:
        1. The Key field displays Authorization by default.
        2. In the Value field, enter the API key provided by the external server.
  14. Click the Events tab and then click Add Event.
  15. In the Name field, enter a name for the event.
  16. From the Event Type drop-down list, select Login or Logout.NOTE: Each event type must be unique. You cannot create more than one event of the same type.
  17. The HTTP Method drop-down list is set to Post by default. This is the only supported method.
  18. From the Request Type drop-down list, select the appropriate request type for the firewall. The options are:
    1. REST
    2. SOAP
  19. For REST Request type:
    1. In the Relative Path (If any) field, enter the endpoint path.
    2. In the Headers section, click Add Header, and then enter a valid header name and value.
    3. From the Content Type drop-down list, select the request payload format. 
      1. JSON (application/json)
      2. XML (application/xml)
      3. XML (text/xml)
    4. In the Content field, enter the supported attributes for the request payload. For a list of supported attributes, see the Supported Payload Attributes table. 

A sample JSON payload is shown below.

				
					{
  "statusType": "${/radius/request/Acct-Status-Type}",
  "userName": "${/radius/request/User-Name}",
  "NASIP": "${/radius/request/NAS-IP-Address}",
  "EventTime": "${/radius/request/Event-Timestamp}",
  "ServiceType": "${/radius/request/Service-Type}",
  "UplinkID": "${/radius/request/SecureW2-AAA-Uplink-Request-ID}",
  "RegionID": "${/radius/request/SecureW2-AAA-Region-ID}",
  "OrganizationID": "${/radius/request/SecureW2-AAA-Organization-ID}"
}

HTTP Event with JSON Request Payload

A sample XML payload for the REST request type is shown below.

				
					<RadiusEvent>
    <statusType>${/radius/request/Acct-Status-Type}</statusType>
    <userName>${/radius/request/User-Name}</userName>
    <NASIP>${/radius/request/NAS-IP-Address}</NASIP>
    <EventTime>${/radius/request/Event-Timestamp}</EventTime>
    <ServiceType>${/radius/request/Service-Type}</ServiceType>
    <UplinkID>${/radius/request/SecureW2-AAA-Uplink-Request-ID}</UplinkID>
    <RegionID>${/radius/request/SecureW2-AAA-Region-ID}</RegionID>
</RadiusEvent>

HTTP Event with XML Request Payload (REST)

  1. For SOAP Request type:
    1. In the Relative Path (If any) field, enter the endpoint path.
    2. In the Headers section, click Add Header, and then enter a valid header name and value.
    3. From the Content Type drop-down list, select the request payload format. 
      1. XML (application/xml)
      2. XML (text/xml)
    4. In the Content field, enter the supported attributes for the request payload.

       

      NOTE: Please provide the content without specifying the Authentication headers. Authentication headers will be added automatically based on the details provided in the Configuration tab.

       

      A sample XML payload for the SOAP request type is shown below.
				
					<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header/>
    <soapenv:Body>
        <RadiusEvent>
            <statusType>${/radius/request/Acct-Status-Type}</statusType>
            <userName>${/radius/request/User-Name}</userName>
            <NASIP>${/radius/request/NAS-IP-Address}</NASIP>
            <EventTime>${/radius/request/Event-Timestamp}</EventTime>
            <ServiceType>${/radius/request/Service-Type}</ServiceType>
            <UplinkID>${/radius/request/SecureW2-AAA-Uplink-Request-ID}</UplinkID>
            <RegionID>${/radius/request/SecureW2-AAA-Region-ID}</RegionID>
            <OrganizationID>${/radius/request/SecureW2-AAA-Organization-ID}</OrganizationID>
        </RadiusEvent>
    </soapenv:Body>

HTTP Event with XML Request Payload (SOAP)

  1. Click Save.
  2. Click Update.

Configuring Certificate Events

Use Generic HTTP to publish certificate events from JoinNow to an external server when a native integration isn’t available. Each time a certificate is issued or revoked, JoinNow sends the event to the HTTP endpoint you configure.

To publish certificate events through a Generic HTTP External Automation, perform the following steps:

  1. Navigate to Integration Hub > Adaptive Defense External Automations.
  2. Click the Add External Automation.
  3. In the Basic section, enter the name of the adaptive defense external automation in the Name field.
  4. In the Description field, enter a description for the adaptive defense external automation.
  5. From the Type drop-down list, select Generic HTTP under Certificate Events.
  6. Click Save.
  7. Click the Configuration tab.
  8. In the Server URL field, enter the firewall URL to which RADIUS accounting events must be pushed.
  9. (Optional) To use your organization’s certificate, select the Custom SSL checkbox.
    1. In the Certificate field, click Choose File.
    2. Select the required certificate and click Upload.
  10. Select the Authentication checkbox.
  11. From the Authentication Method drop-down list, select any one of the following options:
    1. Basic
    2. OAuth
    3. API Key
  12. If you select Basic as the authentication method:
    1. In the Username and Password fields, enter the credentials configured on the external server. JoinNow uses these credentials to authenticate when publishing certificate events.
    2. If you select OAuth as the authentication method:
      1. In the Token URL field, enter the OAuth authentication server URL.
      2. In the Client ID field, enter the Client ID provided by the OAuth server.
      3. In the Client Secret field, enter the client secret provided by the OAuth server.
      4. From the Token Authentication Method drop-down list, select Basic or Request Body.
      5. In the Scope field, enter the required scope.
      6. In the Body section, click Add and enter the required key-value pairs.
    3. If you select API Key as the authentication method:
        1. The Key field displays Authorization by default.
        2. In the Value field, enter the API key provided by the external server.
  13. Click the Events tab and then click Add Event.
  14. In the Name field, enter a name for the event.
  15. From the Event Type drop-down list, select Certificate Issuance or Certificate Revocation.NOTE: Each event type must be unique. You cannot create more than one event of the same type.
  16. The HTTP Method drop-down list is set to Post by default. This is the only supported method.
  17. From the Request Type drop-down list, select the appropriate request type for the firewall. The options are:
    1. REST
    2. SOAP
  18. For REST Request type:
    1. In the Relative Path (If any) field, enter the endpoint path.
    2. In the Headers section, click Add Header, and then enter a valid header name and value.
    3. From the Content Type drop-down list, select the request payload format. 
      1. JSON (application/json)
      2. XML (application/xml)
      3. XML (text/xml)
    4. In the Content field, enter the supported attributes for the request payload.

A sample JSON payload is shown below.

				
					{

"serial": "Issued: ${/clientcertificate/serialhex}",

"notBefore": "${/clientcertificate/notbefore}",

"notAfter": "${/clientcertificate/notafter}",

"subjectCommonName": "${/clientcertificate/subject/commonname}",

"issuerCommonName": "${/clientcertificate/issuer/commonname}",

"sanUpn": "${/clientcertificate/san/upn}",

"sanRfc822": "${/clientcertificate/san/rfc822}",

"sanDns": "${/clientcertificate/san/dns}",

"encodedCertificate":"${/clientcertificate/encodedcertificate}"

}

Certificate Issuance Event with JSON Request Payload

A sample XML payload for the REST request type is shown below.

				
					<certificate>

<serial>${/clientcertificate/serial}</serial>

<notBefore>${/clientcertificate/notbefore}</notBefore>

<notAfter>${/clientcertificate/notafter}</notAfter>

<subjectCommonName>${/clientcertificate/subject/commonname}</subjectCommonName>

<issuerCommonName>${/clientcertificate/issuer/commonname}</issuerCommonName>

<sanUpn>${/clientcertificate/san/upn}</sanUpn>

<sanRfc822>${/clientcertificate/san/rfc822}</sanRfc822>

<sanDns>${/clientcertificate/san/dns}</sanDns>

</certificate>

Certificate Issuance Event with XML Request Payload (REST)

  1. For SOAP Request type:
    1. In the Relative Path (If any) field, enter the endpoint path.
    2. In the Headers section, click Add Header, and then enter a valid header name and value.
    3. From the Content Type drop-down list, select the request payload format. 
      1. XML (application/xml)
      2. XML (text/xml)
    4. In the Content field, enter the supported attributes for the request payload.

       

      NOTE: Please provide the content without specifying the Authentication headers. Authentication headers will be added automatically based on the details provided in the Configuration tab.

       

      A sample XML payload for the SOAP request type is shown below.
				
					<soapenv:Envelope

xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"

xmlns:gs="http://www.baeldung.com/springsoap/gen">

<soapenv:Body>

<gs:postCertificateRequest>

<gs:serial>Issued:${/clientcertificate/serialhex}</gs:serial>

<gs:notBefore>${/clientcertificate/notbefore}</gs:notBefore>

<gs:notAfter>${/clientcertificate/notafter}</gs:notAfter>

<gs:subjectCommonName>$${/clientcertificate/subject/commonname}</gs:subjectCommonName>

<gs:issuerCommonName>${/clientcertificate/issuer/commonname}</gs:issuerCommonName>

<gs:sanRfc822>${/clientcertificate/san/rfc822}</gs:sanRfc822>

<gs:sanDns>${/clientcertificate/san/dns}</gs:sanDns>

<gs:sanUpn>${/clientcertificate/san/upn}</gs:sanUpn>

</gs:postCertificateRequest>

</soapenv:Body>

</soapenv:Envelope>
Certificate Issuance Event with XML Request Payload (SOAP)
  1. Click Save.
  2. Click Update.

Events

Certificate Issuance

Certificate Revoked

More SecureW2 Documentation Explainers