Forum Discussion
NimbostratusAPM AP VPE to value/variable to check and trigger a redirect to logon in case of failed SSO Forms & Auth Failure
Hi,
I am looking for help regarding building a VPE AP workflow that checks a variable/value that would redirect to the Logon page in case User Login Failure? and Assign a WebTop Portal Access resource if User/Pass passes sign-in.
See attached screenshots. The SSO Credentials Mapping is functioning. My various attempts to get the redirect to work are:
session.sso.token.last.username.sso.state
or
use URI path contains: "/?returnurl=/" (for Successful Logon Detection Match Value) and "/login/?returnurl=%2f" (for failure)
Also tried using individual iRule(s), the "iRule Event" with "Empty Action" branch rule expression check to assign a trigger value & assign it a session variable ... to no avail.
Please advise on the best way to make this work & what other information I need to provide? Thank in advance!
7 Replies
Seth_CooperEmployee
Can you setup a AAA object to auth the user before provisioning the Portal webtop? The request to the backend will not happen until you have hit the "allow" ending on the policy and at that point the evaluation is over.
Your best bet is to authenticate the user and then make your provisioning decisions.
Seth
popicaHi Seth,
Thanks for your quick response.
Unfortunately the custom back-end web app does not authenticate user upfront with AD & the application owner is not willing to change this right now.
I guess that leaves us with no solutions right now?
Appreciate your help. Best - Constantin
- popica
the auth is handled by a DB on the service. No integration to AD at all. different password for AD and the app
- Seth_Cooper
Constantin,
Could you by chance use the HTTP AAA object? use the VPE to send a request to the back-end app to auth the user and then send to the portal?
Seth
- popica
I will try your recommendation & keep you posted. Thanks again!
kunjanMay be also can try capture response and do redirect based on response code like 401.
- popica
It's working now by implementing Http Auth + SSO :) Thanks Seth!
Ps: Thanks kujan for your recommandation.
