APM Clientless Mode

Question

Hi list,&nbsp;
Few queries regarding clientless mode-
1) Does every request create a new session id for clientless mode for APM? 
2) When will it clear/remove the session id?&nbsp;

kevin_stewart · Answer

Clientless-mode removes the 302 redirect pattern from the access policy creation and evaluation process. So instead of getting the APM session cookie in that initial 302 redirect to /my.policy, you get it on the first response from the server. Any subsequent requests from the client, assuming the client sends back the session cookie, will use the same session. If the client does not send back the session cookie, then a new APM session is created for each request. The existing sessions will be removed based on the timeout settings in the access policy. &nbsp;

kevin_stewart · Answer

You would normally use an iRule to insert the clientless-mode header:
&nbsp;
when HTTP_REQUEST {
    HTTP::header insert "clientless-mode" 1
}

&nbsp;

john_antony_162 · Answer

Kevin, It's being a while since you answered this question. We have few vendors who uses API calls and the APM's 302 is causing issues. So we decided to introduce clientless mode for only who has issues and leave other traffic as it is.
Requirements:
a)Our external partners will be connecting to our webserver from the internet.
b)We will check for certificate using APM and also check for the certificate subject value.
c)If it matches what we already defined for each vendor, they will be allowed to access the web server and we will configure additional http header X-CUSTOM-UPN “ and also add clientless mode http header value HTTP::header insert "clientless-mode" 1 for vendors that have problem with 302 redirect. For other vendors, we dont use clientless-mode http header.
The rule that I already created:
&nbsp;
when ACCESS_POLICY_COMPLETED {
if {[SSL::cert count] &gt; 0}{
                            set cert [SSL::cert 0]
                            set subject [string tolower [X509::subject $cert]]
                            set clientIP [IP::client_addr]
                            if { $subject contains “cn=vendor-a.mycompany” }
                                            {
                                            HTTP::header insert X-CUSTOM-UPN vendor-a
                                            }
            elseif { $subject contains “cn=vendor-b.mycompany.com” }{
    We only wanted clientless mode for specific applications that cant handle the 302 redirect coming from F5.
                                            HTTP::header insert X-CUSTOM-UPN vendor-b
                                            HTTP::header insert “clientless-mode” 
                    } else {
                    log $clientIP
                                            log local0. “cert CN not valid”
                                            reject
           }                                               
                            }
}

&nbsp;
As you noticed, I put them under ACCESS_POLICY_COMPLETED. So this does not help as to redirect to APM's my.policy, there will be a 302. So I tried to put them under HTTP_REQUEST and it is still not working. What am I missing?

michael__ · Answer

I guess "ACCESS_POLICY_COMPLETED" is to late since the header is needed in an early request so the APM react - it should be used in "HTTP_REQUEST" like Kevin's example.
Also in your pasted code/irule the "1" is missing in the header command, should be:
&nbsp;
HTTP::header insert "clientless-mode" 1
&nbsp;
... maybe you can also try "replace" which in rare cases works better then "insert"

john_antony_162 · Answer

Sorry; I missed the 1 while pasting it here. I will try to use "replace" instea dof insert.&nbsp;
Another question:
I used this iRule along with APM policy where I check AD group membership. I used print statement to follow the traffic flow within iRule and also within APM.&nbsp;
I noticed that the flow only hits iRule and not passing thru the APM. So my AD group check fails. What am i missing?&nbsp;

Forum Discussion

APM Clientless Mode

9 Replies

AppWorld Berlin iRules Contest!

F5 AppWorld 2026 Las Vegas - iRules Contest Winners!

Recent Discussions

Logical Disk Full to Migrate rSeries

Priority Group Activation is not working

Changes to DO and AS3 GitHub - no longer monitored

SSL Forward Proxy, iRules and Client Hello

monitor/healthcheck issue with envoy gateway

Related Content

APM Clientless certificate authentication

Yubikey Authentication Modes and Azure AD integration via the APM

Explanation of F5 DDoS threshold modes

Embedding APM Protected Resources into Third-Party Sites

APM authentication for a sessionless and clientless API

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS