Forum Discussion

cvca's avatar
cvca
Icon for Nimbostratus rankNimbostratus
Jun 19, 2015

APM access policy default logout URI override based on landing URI?

Hi, we have currently an APM access policy that splits in different branches, based on the landing URI. All works fine, but when we log out, the default behavior is to redirect the client for any further new sessions back to root (/). I know that this can be customized under Access Policy -> Customization, but then it's valid for the entire access profile. We would like to reuse the initial landing URI, so that each application can be relaunched again after logout, with the original landing URI that was previously entered. I don't find any setting in VPE (maybe this logout URI can be overridden by the landing URI by passing a parameter), or does anyone has any experience in doing this with either policies, either iRules? An example would be appreciated :)

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
hp
iRules
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 25, 2018

    Here is the code which must be edited (around line 111-117 in version 13.1.0):

     

            
            
                "); }else{ if ($errorcode == 1) { print('%[error_message]
'); } else { include_customized_page("errormap", "errormap.inc"); print("
"); } } ?>
                %[thank_message]
'); } ?>

     

    The third if condition must be edited to replace:

    "); }else{ if ($errorcode == 1) { print('%[error_message] '); } else { include_customized_page("errormap", "errormap.inc"); print(" "); } } ?> %[thank_message] '); } ?>

    The new code is :

     

            
            
                "); }else{ if ($errorcode == 1) { print('%[error_message]
'); } else { include_customized_page("errormap", "errormap.inc"); print("
"); } } ?>
                %[thank_message]
'); } ?>

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 21, 2015

    interesting, this wasn't possible in the past, you had no access to session variables after logoff, that seems to have changed then. which version is this on?

     

  • cvca's avatar
    cvca
    Icon for Nimbostratus rankNimbostratus
    Jun 19, 2015

    hmmm, some html lines got interpreted in above... anyway, you should replace the '/' in line 114 href by exactly "%{session.server.landinguri}"

     

  • cvca's avatar
    cvca
    Icon for Nimbostratus rankNimbostratus
    Jun 19, 2015

    Hi Stanislas,

     

    your suggestion was indeed the simplest way forward! I modified the logout page and added a value pointing to the session parameter %{session.server.landinguri}, after struggling a bit with the right syntax... :) So, to implement this, you go as follows:

     

    Access Policy -> Customization:Advanced -> Customization settings -> Access Profiles -> "YOUR PROFILE" -> Logout ->logout.inc

     

    around line 114 replace:

     

    and you're done. I didn't test all cases and all exit branches yet, but for those tested, it worked fine. After hitting the logout button, clients gets the opportunity to start a new session, which will be automatically on the same starting URI as his previous session, and no longer the root (/)

     

    Thanks!

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jun 19, 2015

    I did not know how to change the default redirect after logout in customization. I did not this before.

     

    If it's possible, did you try to change this value to %{session.server.landinguri} ??