Forum Discussion
APM On-Demand cert auth failing for curl command line client
Had a requirement for a site that was moving from Apache with ACL's over to F5 in front of an Apache instance, that only requires a user certificate authentication for a specific /uri. For the SSL profile, I have to leave it at ignore, as request would always request a cert even for the other uri's.
In an irule I have an if statement in the HTTP_REQUEST block that says if the uri startswith /blah ACCESS::enable, else ACCESS::disable.
This works as desired for a browser client, but when using:
curl -k --cert ./mlanghorst_cert.pem --key ./mlanghorst_key.pem --cacert CA5_bundle.pem https://mydomain/protected_path/index.html
It doesn't seem to present the cert to the F5, since the SSL profile is ignore, it doesn't seem to renegotiate for the client cert.
Ideas on how to fix this?
Try to enable clientless-mode for APM. Without this APM responses with a redirect to establish a session.
- mlanghorst
Nimbostratus
Should've mentioned that. I've tried setting that header via curl -H 'Clientless-Mode: 1'. and within the irule:
#Set clientless mode for API
HTTP::header insert "clientless-mode" 1Setting verbose, I see I'm getting a 302 redirect. If I add the -L switch, I get returned the my.policy page telling me I've been denied access.
Also you may try API protection profile as I think you are getting redirection based on APM login page or something like that. You can't use client cert but oauth access token is something similar as this is only what you have:
https://clouddocs.f5.com/training/community/access-solutions/solution13/guide/guide.html
https://www.youtube.com/watch?v=-2ndGH9Dp1Q
The oauth server can still accept the client ssl cert before giving the token:
https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-access-policy-manager-oauth-configuration-14-1-0/using-apm-as-an-oauth-2-server.htmlAlso try a per-request policy https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-authentication-methods/on-demand-certificate-authentication.html-----------------
When configuring On-Demand certification authentication in a
per-request policy, avoid having any other agent before the On-Demand Cert Auth agent if the client SSL profile on the virtual server has the
Client Certificatefield set to
ignore. This configuration makes the per-request policy re-execute the subroutine when it reaches the On-Demand Cert Auth agent. This can cause the per-request policy to go to the unexpected branch on each agent located before On-Demand Cert Auth agent.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com