Forum Discussion

Asura2003's avatar
Asura2003
Icon for Nimbostratus rankNimbostratus
Jun 24, 2024

APM parse HTTP Connector json to message box, iRule etc.

Hello all,

I have configured per-session and per-request policies on my APM (APM+LTM) mode and in the process of authentication I want to get some data from external web server. Data is in JSON format. To do that I have created HTTP Connector, assigned it to my per-request policy via subroutine and i can see that the subsession variables are beeing populated correctly via the HTTP Connector (with option save data, i can parse it but the result is the same, just more variables - one per JSON field). In the Overview:Active Session i can see subsession with the following variable with my data:

879cb369./Common/HTTPConnector/XXXXXXXXXXX==.nvp_block.subsession.http_connector.body

 

Now I wanted to get this data and use it in my authentication flow and iRule but it doesn't work.

 

First I wanted to test it, by assiginig variable and showing a simple message box in PerReq-policy:

And after that the massage box with: %{perflow.custom} - it doesnt work.

 

Also tried to just show it in logs with iRule like in documentation ltm rule command ACCESS perflow (f5.com)

So i created an iRule agent in per-request-policy pointing to bellow iRule and attached iRule to my VS:

 

when ACCESS_PER_REQUEST_AGENT_EVENT {

set $body [ACCESS::perflow get subsession.http_connector.body]

log local0. $body

}

But it doesnt show anything.

 

I have few questions:

  1. Is it even possible to access variables in subsession that got retrieved via HTTPConnector and use it further? For example to build JWT for auth?
  2. Can I assign more than two custom variables from subsession? according to this guide i can only use perflow.custom and perflow.scratchpad?:
    Using Variable Assign to populate gating criteria,Using Variable Assign to populate gating criteria,Using Variable Assign to populate gating criteria (f5.com)

Using Variable Assign to populate a perflow variable other than perflow.custom and perflow.scratchpad causes subroutine results to become unreliable.

3. Maybe there is an other option to achieve my goal?

 

 

application delivery
event
security
    • Asura2003's avatar
      Asura2003
      Icon for Nimbostratus rankNimbostratus
      Jun 26, 2024

      Thank you for your answers, but i feel that parsing JSON data shouldn't be a problem according to this git project by pmscheffler where he uses HTTP Connector and json data collected with it:

      sidebandauth/auth-iRule.tcl at main · pmscheffler/sidebandauth · GitHub

      My problem is that i cannot get the data to variable in irule to first show the data in logs (log local0.) to be sure that I get the date i have this simple iRule

      when ACCESS_PER_REQUEST_AGENT_EVENT {
    set id [ACCESS::perflow get perflow.irule_agent_id]
     if { $id eq "irule_agent_one" } {
		log local0. "iRule agent $id PRP."
                                                   }
    set log1   [ACCESS::perflow get subsession.http_connector.body ]
    set log2  [ACCESS::perflow get subsession.http_connector.status ]	    

    log local0. "Log1 $log1"
    log local0. "Log2 $log2"
}

      But it shows error in ltm.log:

      perflow variable name (subsession.http_connector.body) invalid (line 7)     invoked from within "ACCESS::perflow get subsession.http_connector.body "

      and like i wrote before i  have a subsession:

      879cb369./Common/HTTPConnector/XXXXXXXXXXX==.nvp_block.subsession.http_connector.body

      The variable perflow.irule_agent_id shows in the logs so in my opinion its not like the variable is for example not yet populated?

       

      • JoshBecigneul's avatar
        JoshBecigneul
        Icon for MVP rankMVP
        Dec 03, 2024

        I noticed in the example from your LTM log message there may be a trailing space on the error:

        Perhaps try modifying the iRule to use something like this, with the spaces removed. 

        set log1 [ACCESS::perflow get subsession.http_connector.body] 
set log2 [ACCESS::perflow get subsession.http_connector.status]

         

  • zamroni777's avatar
    zamroni777
    Icon for Nacreous rankNacreous
    Jun 25, 2024

    you should use node.js based iruleslx, instead of usual tcl based irules, as node.js handles json natively.

    there are some examples you can explore:
    apm iruleslx