Configuring Root URL Redirection on Identity Security Platform

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Following a migration from the NGINX Ingress Controller to OpenShift Routes on Identity Security Platform (IDSP) version 4.0.x, HTTP requests sent directly to the root path (e.g., [https://example.com/](https://example.com/)) may fail to redirect to the designated web interface.

Under NGINX Ingress Controller setups, this behavior was previously managed using the nginx.ingress.kubernetes.io/app-root annotation to return an HTTP 302 Found response pointing to a specific path (such as /portal/ or /common/ui/v1/selfserviceconsole/). With the OpenShift router architecture handling root requests by default, root-level HTTP redirection must be explicitly configured in the deployment settings.

Environment

 

• Product: Identity Security Platform (IDSP)

• Release Version: 4.0.4 and later

 

Cause

OpenShift Native Routes do not natively process NGINX-specific annotations such as app-root. When routing shifts to the OpenShift router component, requests directed to bare root URLs lack target destination rules unless defined in the platform configuration.

Resolution

Starting in IDSP version 4.0.4, root path redirection parameters have been added to the deployment configuration parameters to enable automatic HTTP 302 redirects for both standard and full vanity hostnames.

Update your Helm values or deployment configuration using the appropriate settings:

• For Non-Vanity Hosts (Standard Host Redirection):

  Configure the global root redirect path parameter:

   

  ssp:
    ingress:
      rootRedirect: "/portal/ui/"
  

• For Full Vanity Hosts (End-User Vanity Redirection):

  Configure the root redirect path specifically for end-user vanity hostnames:

   

  ssp:
    ingress:
      endUsersVanity:
        rootRedirect: "/common/ui/v1/selfserviceconsole/"
  

Redirection Logic Notes:

1. ssp.ingress.endUsersVanity.rootRedirect acts as the primary redirect for all end-user vanity hosts regardless of type.

2. If ssp.ingress.endUsersVanity.rootRedirect is set, it overrides ssp.ingress.rootRedirect for end-user vanity requests.

3. Standard (non-vanity) host requests will continue to use ssp.ingress.rootRedirect.

Verification

To verify that root redirection is active, send a GET request to your host's root URL:

 

curl -I https://<your-hostname>/

Expected Response:

 

HTTP/1.1 302 Found
Location: https://<your-hostname>/portal/ui/