For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

daboochmeister's avatar
daboochmeister
Icon for Cirrus rankCirrus
Jul 29, 2015

APM portal - user bookmarks to /my.policy - any way to redirect?

Environment: LTM 11.5.2 with APM

 

We have users who have bookmarked a link to our portal, but did so after accessing, so the bookmark has /my.policy in the URL. Then they shared it. Widely. So now, users access, and the very first thing they see is an error page saying "Your session could not be established".

 

So, we're working the user communication to get this corrected, but in the meantime - is there a way to detect that condition, and redirect them to the portal login? We would want the redirect to happen only if they came directly to /my.policy - I'm sure there are other scenarios where their session could not be established and we would want them to see that error page.

 

BIG-IP Access Policy Manager (APM)
security

2 Replies

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Jul 29, 2015

    You could try something like this:

    when CLIENT_ACCEPTED {
     Allow access to APM specific pages (this may not be necessary for the my.policy page)
    ACCESS::restrict_irule_events disable
}

when HTTP_REQUEST {
    if { [HTTP::uri] equals "/my.policy" } {
        log local0. "Path: my.policy"
        log local0. "  Access: '[ACCESS::policy result]'"

        if { [ACCESS::policy result] equals "" } {
            log local0. "  Invalid request (user bookmark?)"

             Redirect to the desired uri
            HTTP::respond 302 Location "/"
            return
        }
    }
}

    If the user comes to the 

    my.policy
    page and the policy result is empty, then their session hasn't started (it should be something like 
    not_started
    at this point I think).

  • Walter_Kacynski's avatar
    Walter_Kacynski
    Icon for Cirrostratus rankCirrostratus
    Jul 29, 2015

    You could also manipulate the landing URI that is sent back after policy completion via:

    when ACCESS_SESSION_STARTED {
    if { [ACCESS::session data get session.server.landinguri] equals "/my.policy" } {
         Force the User to the root URL if they arrive at the my.policy URL directly
        ACCESS::session data set session.server.landinguri "/"
    }
}