How to add additional routing rules to a End Users Vanity domain to allows Admin APIs call?

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

There is a business requirement to call Session Management Admin APIs via an End Users Vanity domain that is accessible through the Internet. Currently Session Management Admin API calls are only available via a Full Vanity domain.
Can we add additional routing rules to a End Users Vanity domain to additionally allow Session Management Admin APIs call?

Environment

VIP Authentication Hub 3.x

Resolution

We can create a new or duplicate ingress object with additional routing rules for the admin endpoint/paths to achieve this objective. Please avoid modifying the existing SSP ingress by adding new routing rules. Changes made to SSP objects can be reverted during upgrades, potentially causing downtime for the affected routes

To create additional ingress routing rules for Session Management admin paths, do the following:

1) To duplicate the enduservanity object, export it using an `kubectl get ingress -o yaml` command: 
e.g.
         kubectl get ingress -n ssp ssp-ssp-ingress-endusersvanity -o yaml > additionalEnduserPaths.yaml

2) Edit additionalEndusersPaths.yaml file and change the following:
     a) The name of the object (under metadata.name) to other unique ingress name, e.g. ssp-ssp-ingress-endusersvanity-addition
     b) Replace the existing routes with

      - backend:
          service:
            name: ssp-ssp-admin
            port:
              number: 443
        path: /(.*?)/(admin/v1/UsersSessionsAndRefreshTokens/.*)$
        pathType: ImplementationSpecific
      - backend:
          service:
            name: ssp-ssp-admin
            port:
              number: 443
        path: /(.*?)/(admin/v1/UsersSessions/.*)$
        pathType: ImplementationSpecific
      - backend:
          service:
            name: ssp-ssp-admin
            port:
              number: 443
        path: /(.*?)/(admin/v1/Sessions/.*)$
        pathType: ImplementationSpecific
      - backend:
          service:
            name: ssp-ssp-admin
            port:
              number: 443
        path: /(.*?)/(admin/v1/RefreshTokens/.*)$
        pathType: ImplementationSpecific
      - backend:
          service:
            name: ssp-ssp-admin
            port:
              number: 443
        path: /(.*?)/(admin/v1/UsersRefreshTokens/.*)$
        pathType: ImplementationSpecific

3) Apply the edited file using 
e.g.
         kubectl apply -f additionalEnduserPaths.yaml

Additional Information

See also Configuring a Vanity URL for a Tenant