XPath-related context variables cannot be accessed outside the current policy scope

Products

• STARTER PACK-7
• CA Rapid App Security
• CA API Gateway

Issue/Introduction

Solution

Background

The Layer 7 Gateway will store context variables resulting from XPath evaluations for use in other assertions or audits. These context variables are maintained within the scope of whatever policy is being executed. If an XPath is evaluated in a published service policy then it will not be available in Included Policy Fragments, Global Policy Fragments, or?the?Internal Audit Sink Policy. If an XPath is evaluated in any of those example policies then the context variables will not be available in the other policies--including the original service policy. This is done to avoid system resource utilization issues for larger XML messages or broad XPath expressions.

Presentation

Take the following example service policy:

<Please see attached file for image>

The intention of this service policy is to evaluate an XPath expression on an inbound request. An included policy fragment is comparing the result of the XPath with a known value. If that comparison passes then a template response is returned to the requestor. This service policy will fail with the following abridged SOAP fault when set to?Full Detail?(with the critical message emboldened):

<l7:policyResult status="Error in Assertion Processing"

? xmlns:l7="http://www.layer7tech.com/ws/policy/fault"?

? xmlns:l7p="http://www.layer7tech.com/ws/policy">

??<l7:assertionResult?assertion="l7p:RequestXpathAssertion" status="No Error">

? ? <l7:detailMessage id="4708">XPath pattern found an element</l7:detailMessage>

? </l7:assertionResult>

? <l7:assertionResult?assertion="l7p:ComparisonAssertion" status="Error in Assertion Processing">

? ? <l7:detailMessage id="-6">No such variable: requestXpath.result</l7:detailMessage>

? ? <l7:detailMessage id="152">Unsupported variable: requestXpath.result</l7:detailMessage>

? ? <l7:detailMessage id="7103">At least one comparison value was null</l7:detailMessage>

? </l7:assertionResult>

? <l7:assertionResult assertion="l7p:All" status="Error in Assertion Processing"/>

? <l7:assertionResult assertion="l7p:Include" status="Error in Assertion Processing"/>

? <l7:assertionResult assertion="l7p:All" status="Error in Assertion Processing"/>
</l7:policyResult>

The following log entries may also be printed:

com.l7tech.server.MessageProcessor: 3017: Policy evaluation for service XPath [8f7ee52efeca68eea4d97afedb90bb8c] resulted in status 601 (Error in Assertion Processing)
com.l7tech.external.assertions.comparison.server.ServerComparisonAssertion: 7103: At least one comparison value was null
com.l7tech.external.assertions.comparison.server.ServerComparisonAssertion: 152: Unsupported variable: requestXpath.result
com.l7tech.server.message: Message was not processed: Error in Assertion Processing (601)

Resolution?

This issue can be resolved by including the?Export Variables from Fragment?assertion to the example policy above. This assertion ensures that the variables created in a particular policy can be exported to other entities (such as Included Policy Fragments, Global Policy Fragments, or the Internal Audit Sink Policy). The example policy with the assertion added and configured would appear as follows:

<Please see attached file for image>

Any context variables checked in the dialog above will be available in some manner in other policy documents when executed during a single message processing attempt. For more information on this functionality, review the Export Variables from Fragment?section of the?Layer 7 Policy Authoring User Manual.

Environment

Release:
Component: APIGTW