Forum Discussion

Nikolay_Matveev's avatar
Nikolay_Matveev
Icon for Nimbostratus rankNimbostratus
Apr 05, 2016

APM: how to gracefully logout from all SSO applications behind BigIP

Dear Community,

 

I have 3 different web applications sitting behind a BigIP which does SSO across all three of them (they are 2 x Kerberos and 1 x Forms if this is relevant at all in the context of the question). All applications are somehow logically connected and dependent on each other and thus there is a need to gracefully terminate user sessions on all three of the applications (to release locks on resources etc.) when a user logs out from just one of them.

 

I would also like to send logout requests to all three of the applications when APM Inactivity and Maximum Session timeouts expire.

 

Is there an event triggered when APM timers expire? May be somebody has done/seen an iRule implementing similar functionality? Any clues would be very much appreciated!

 

application delivery
BIG-IP Access Policy Manager (APM)
iRules
security

4 Replies

  • Walter_Kacynski's avatar
    Walter_Kacynski
    Icon for Cirrostratus rankCirrostratus
    Apr 05, 2016

    If you applications can link to /vdesk/hangup.php3 for the sign out process, then your APM session will be terminated.

     

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Apr 05, 2016

    Another option (though not the prettiest or easiest) would be to intercept a request to /vdesk/hangup.php3 (or a response redirect to that page) and present the user with a custom page that uses AJAX calls to request the individual logout pages of the applications, and once completed, redirects the user to the hangup page again with a query parameter or something that would denote it should be intercepted again.

     

    iRule code might start like this:

     

    when HTTP_REQUEST { 
    set hostvar [HTTP::host] 
    set urivar [HTTP::uri] 
} 

when HTTP_RESPONSE { 
    if { [HTTP::header exists Location] && [HTTP::header value Location] equals "/vdesk/hangup.php3" } { 
        HTTP::respond 200 content { 
            Your page here 
        } Cache-Control No-Cache Pragma No-Cache 
    } 
}

    Also, if you're interested in APM event flow, you can check out this article which gives a flowchart of most of the events there.

     

  • Nikolay_Matveev's avatar
    Nikolay_Matveev
    Icon for Nimbostratus rankNimbostratus
    Apr 19, 2016

    Thank you very much to all who answered my question (and sorry for not getting back to you sooner!)

     

    Without any further investigations it looks like the approach suggested by Michael Jenkins has the best chances to succeed. AJAX on the client side should be much easier than trying to identify all server-side sessions.

     

    Michael, that flowchart is also very helpful - thanks a lot for the link!

     

    I'm currently dealing with something else but as soon as I get back to this topic (probably in a few weeks time) and work out a suitable solution I will update this post.