IDSP Returns "Invalid Vanity Host" (Error 0000043) on the MGMT Host Sign-In Flow When Behind an external network gateway
Article ID: 452463
Updated On:
Products
Issue/Introduction
Running IDSP configured to use an external networking environment, when trying to reach:
https://ssp-mgmt.example.com/system/ui/v1/signin/
the frontend loads, but an error occurs during the XHR call to:
https://ssp-mgmt.example.com/system/ui/v1/signin/token
{"errorCode":"0000043","errorMessage":"Invalid vanity host"}
Cause
As per a specific network configuration, the request is reaching the backend service without going through the router.
If the management host is not passed to the SSP chart, the chart defaults to assuming that mgmt-<ssp-host> is the management host.
At runtime, the Host header is used by the tenant filter to match the incoming request to a tenant. The tenant filter logs both (a) the incoming parameters it uses to make this decision, and (b) the final decision.
The ssp-router needs to see the original management FQDN in the Host header — verify that no upstream network resource (VirtualService, Gateway, or an intermediate proxy) is rewriting or stripping it before the request reaches ssp-router.
Resolution
In this case, having configured:
- ssp.ingress.mgmt.host set to ssp-mgmt.example.com
- ssp.ingress.mgmt.enabled set to false
In this configuration, ensure that the gateway handling the incoming requests preserves the original Host header to be sent to the ssp-router (1) to fix this problem.
The MGMT host is API-oriented and has no UI. Based on the business needs, this may have been configured this MGMT host to a custom value instead of the default one.
This MGMT is a reserved host name, starting with mgmt-${PREFIX}.${DOMAIN} by default. It can be managed mainly using Postman (2).
The System APIs are accessible through the MGMT host. The System tenant is used to manage items that are used system-wide, such as:
- Global settings
- Tenant settings
- General security configuration
- Provider configuration
- Fraud and risk
- Localization
- FIDO
The System tenant is intended to be API-only and is accessible only through the MGMT host.
Infrastructure management operations are also reachable through the MGMT host, including:
- Service health checks
- Retrieve all application configurations
- Retrieve all AuthN policies
- Retrieve all AuthZ policies
- Retrieve all global settings
- Retrieve all settings for the System tenant
This is the default configuration, and it can be modified by setting ssp.ingress.mgmt.enabled to false, as it has been done.
Additional Information
Feedback
