For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nickr_109107's avatar
nickr_109107
Icon for Nimbostratus rankNimbostratus
Jun 10, 2014

APM SSO for a downstream forward proxy

Does anyone know a way to make APM SSO work when presented with 407 pages?

 

I have a requirement to put APM in front of a 3rd party forward proxy server with APM. The proxy only supports authentication via NTLM via a 407 page and NTLM. For a bunch of reasons, I'd like to be able to have users log on once to APM via a form, then when they want to access resources via this proxy have the APM respond to the 407 on their behalf. APM SSO seems to respond fine to 401 messages, but not 407.

 

I'm sure that if it was basic auth instead of NTLM in the 407, then I could put together an iRule that built a proxy authorisation header out of session variables. But that would involve sending credentials in the clear. So I'd much prefer to use NTLM.

 

All ideas warmly appreciated.

 

BIG-IP Access Policy Manager (APM)
design
security

1 Reply

  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Jun 11, 2014

    Create a virtual, attach an iRule, map 407 responses to 401 responses. Point APM at the virtual, point the virtual at the proxy.

     

    The iRule to map responses would be something similar to this

     

    If there are protocol/payload differences it would be up to you to manage them in the iRule. I am not suggesting this would be simple. Click your heels together and check the RFC behaviour in both cases.