For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

PEsp_275235's avatar
PEsp_275235
Icon for Nimbostratus rankNimbostratus
Aug 11, 2016

APM Session deleted (internal_cause) when open webtop in new browser tab

Hello,

 

I'm trying APM (v12), and can not open a same webtop session in different tabs of my browser (first session is deleted)

 

Without webtop assignment, it seems to be normal:

 

  • when an access policy does not containt webtop, an open VS url, APM ask me auhtentication, and when successull, the website associated to VS (IIS Pool) is displayed
  • next when I open a new tab in same browser to the same VS url, the website behind is displayed without authentication in the same session

But if I assign webtop and link to this access policy (and after closing all sessions and tabs to be clean), first session is deleted

 

  • when I go to the VS url, after successfull authentication, the webtopage is displayed => normal
  • next when I open a new tab in same browser to the same VS url First session is deleted ! in apm log: "Session deleted (internal_cause)" Refreshing the first tab displays "Your session is finished." New tab asks me authentication for a new session

I have this problem on different (and all) VS/Access policy

 

Is it normal ? (no way to open same webtop on different tabs)** If not, do you know this problem and solution ? Where can I find more explicit log than "Session deleted (internal_cause)" ?

 

Pascal

 

BIG-IP Access Policy Manager (APM)
security

3 Replies

  • Stephan_Mierau's avatar
    Stephan_Mierau
    Icon for Employee rankEmployee
    Aug 11, 2016

    to get more log information set it to debug. I think when you use a webtop, the APM does a rewriting of the webpage, so only one session is allowed (portal access). In the first case you use APM/LTM without rewriting

     

  • PEsp_275235's avatar
    PEsp_275235
    Icon for Nimbostratus rankNimbostratus
    Aug 11, 2016

    Thank you Stephan, your explanation could be the cause. Debug mode does not give me more information. Do you have a webtop in your environment, and so could you say me if you have the same results ?

     

    Pascal

     

  • sharang_201287's avatar
    sharang_201287
    Historic F5 Account
    Nov 11, 2016

    I guess this is by design. The APM terminates old session in favor of new session. Try this irule to keep the old session intact;

    apm_dont_logout_if_new_tab Tested in v11.4.0 If you hit APM logon page with another already-logged-in browser tab or window open, your old APM session is destroyed, in favor of the new one. This workaround irule looks up the existing session and will return an error page instead. This functionality is different than other typical Web applications, where a log-in is required to destroy the old session. APM sets the session cookie immediately upon hitting the login page, in order to allow a more flexible approach to the programmability of the login process.

    when RULE_INIT { mode 1 = display error page on user browser if logged on user is already active mode 2 = redirect the user to their current landing URI (full webtop, etc)

    Set mode here \/

    set static::mode 2

    }

    when HTTP_REQUEST { if { ([HTTP::uri] == "/") && [HTTP::cookie exists MRHSession ] && [ACCESS::session exists] } { HTTP::close

    switch $static::mode {
  1 {
    HTTP::respond 200 content "Please close 
    this browser window or exit your current remote access session before visiting 
    the login page.
Or, "
  }

  2 {
    set starturi [ACCESS::session data get "session.policy.result.start_uri"]
    log local0. "redirecting to starturi: $starturi"
    HTTP::respond 302 Location "$starturi"
  }
  default {
    return
  }
}
return

    } }

    Heading