For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Martin_Robbins's avatar
Martin_Robbins
Icon for Nimbostratus rankNimbostratus
Feb 25, 2014

APM modify VPE flow state

Hello,

 

Within an APM access policy, if you have a basic logon page followed by an AD query to check if the username exists in a domain. If the result of the username AD Query passes, it then proceeds to AD Auth against domain ONE otherwise do an AD Auth against domain TWO

 

If a user enters an incorrect 'username' that does not match the AD query they enter the "wrong" AD auth state for domain TWO in VPE.

 

Then if the client corrects the 'username' for domain ONE, is there anyway to re-run the AD query again as there login will always then fail against domain TWO ?

 

.. or is starting a whole new session the only way to restart the VPE state ?

 

.. or is there someway to run an AD Query and/or AD Auth from within an iRule

 

Thanks for any hints.

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
iRules
security

5 Replies

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Feb 25, 2014

    Hi,

     

    You should be able to have the "Logon Page" and "AD Query" in a Macro and let it loop. So the workflow would be they login, hit AD Query, if name doesn't match one of the two domains then they loop back to the login page to correct the userid. You can have them loop "x" amount of times and then if it still fails then send them to a "Deny" ending.

     

    Seth

     

  • Martin_Robbins's avatar
    Martin_Robbins
    Icon for Nimbostratus rankNimbostratus
    Feb 26, 2014

    Hi,

     

    Great, thanks for the answer indeed a loop does work but ..

     

    .. is there anyway to add an error into the logon page if the lookups fail ?

     

    I have tried setting the session variable session.logon.page.errorcode but nothing is displayed.

     

    Any ideas ?

     

    thanks

     

  • Martin_Robbins's avatar
    Martin_Robbins
    Icon for Nimbostratus rankNimbostratus
    Feb 28, 2014

    Hi,

     

    That's great thanks very much for your help !!!

     

    Final question, do you know if within the Macro loop whether there is a counter ?

     

    regards

     

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Feb 28, 2014

    You can configured the Maximum Macro Loop Count in the settings for the Macro. I don't see a session variable that is available out of the box that tracks how many times the loop has happened. You could always set your own counter if needed.

     

    What is your reason for the counter? Are you wanting to display or log the count?

     

    Seth

     

  • Martin_Robbins's avatar
    Martin_Robbins
    Icon for Nimbostratus rankNimbostratus
    Feb 28, 2014

    Actually I wanted to change the number of retries on one of the AD's but I created a custom variable assigment on entry to the macro and incremented it.

     

     

     

    "Loop Count Inc"

     

    session.custom.auth.loop.count = expr { [mcget {session.custom.auth.loop.count}] + 1 }

     

     

    Thanks again.