Deepak Prasad

ServiceNow business rules interview questions for {year}: before, after, async, display, and query rules, Order field, current and previous, recursion, ACL vs query BR, debugging, and scenarios—with sample answers.

Configure Keycloak SAML Single Logout, inspect LogoutRequest and LogoutResponse messages, verify sessions on both realms, and diagnose a successful response that never reaches the service provider.

See why an Envoy Gateway WebSocket drops after HTTP 101, how the default stream idle timeout works, and how to tell a proxy close from a backend close.

Sign Keycloak SAML responses and assertions, require signed AuthnRequests, encrypt assertions to the service provider certificate, and check the XML with the peer public key.

See why Envoy Gateway returns HTTP 504 upstream request timeout at about 15 seconds, and how HTTPRoute timeouts.request and backendRequest change that deadline.

See why Envoy Gateway returns HTTP 408 when an upload arrives too slowly, and why that clock is not a body-size limit or proxy-read-timeout.

See why ingress-nginx proxy-read-timeout is an inactivity gap, and why copying that number onto HTTPRoute timeouts.request is a different deadline.

Tell an Envoy Gateway 504 from a slow-upload 408 and from an ingress-nginx proxy-read-timeout, and open the page that matches the failure.

Replace ingress-nginx proxy-body-size with Envoy Gateway requestBuffer.limit, and see why that policy buffers the whole request before it returns HTTP 413.

Bootstrap a local CA with cert-manager, sign an Envoy Gateway certificate from that CA, and verify HTTPS with curl --cacert when the hostname has no public DNS.

Fix a Keycloak SAML invalid signature by comparing certificate fingerprints, checking whether the response or assertion was signed, and separating a stale key from an unsigned AuthnRequest.

Compare a Keycloak SAML login that starts at the service provider with one that starts at the IdP-initiated client URL, including RelayState, InResponseTo, and the broker path that accepts an unsolicited response.

Keycloak rejects a SAML assertion when AudienceRestriction does not contain the service provider entity ID. Match the SAML client ID to that entity ID, and add an audience mapper only for an extra audience.

Decode a Keycloak SAMLResponse or SAMLRequest on Linux. HTTP-POST is Base64 XML. HTTP-Redirect is DEFLATE, then Base64, then URL encoding. Read Issuer, Destination, NameID, and Audience locally.

Move an existing oauth2-proxy login from ingress-nginx to Envoy Gateway, replace auth-url with a SecurityPolicy, and avoid the 202 response that does not admit the request.

Split requests between two app versions with HTTPRoute backend weights, map that ratio to ingress-nginx canary-weight, and roll the canary back to zero.

Keycloak shows Invalid redirect uri when a SAML AssertionConsumerServiceURL is not a Valid Redirect URI. Register the exact ACS, and use the POST binding or Master SAML Processing URL only when the request omits one.

See how cert-manager fills an Envoy Gateway TLS Secret with Let's Encrypt, why HTTP-01 needs port 80, and how to read the renewal time before the certificate expires.

Choose a Keycloak SAML NameID format and value, including email and a user attribute, and check the NameID element against what the service provider requested.

See how ingress2gateway handles rewrite-target and regex paths, why a capture group can arrive as the literal path /$2, when to use ReplacePrefixMatch, and how to preserve capture groups with an Envoy HTTPRouteFilter.

Map a Keycloak realm role, a client role, and a group into an outgoing SAML assertion, then limit which names the service provider receives.

Keep ingress-nginx serving while you convert one hostname to a Gateway and HTTPRoutes, compare Envoy on its own address, and change DNS only after the paths match.

Add a Keycloak user attribute and email to an outgoing SAML assertion with a protocol mapper, then read the Attribute element in the response.

Download a Keycloak SAML IdP descriptor, read the entity ID, SSO URL, and signing certificate, then import it into a second realm and check the broker SP metadata.

Configure SAML SSO with one Keycloak realm as the IdP and a second realm as the SP/broker, then finish one SP-initiated login on Keycloak 26.8.0.

Provision Keycloak users and groups with the SCIM 2.0 API: create, search, update, deactivate, and delete accounts, including PATCH, filters, and an enterprise user attribute.

Diagnose Keycloak SCIM 401 and 403 errors with curl: missing bearer tokens, invalid token audience, realm-management permissions, and protected admin resources.

Enable the Keycloak SCIM 2.0 API, configure a realm and service-account client, fix the token audience, and test SCIM endpoints with curl.

Convert an attached EBS gp2 volume to gp3 online with modify-volume, monitor describe-volumes-modifications, tune gp3 IOPS and throughput, and verify the filesystem and data stay intact on RHEL 10.2 in ap-south-1.

Why AWS Systems Manager Session Manager returns TargetNotConnected, how to confirm account and Region, read Fleet Manager ping status, verify the SSM agent and instance profile, check outbound HTTPS and VPC endpoints, …