Forum Discussion

Philipp_Stadler's avatar
Philipp_Stadler
Icon for Nimbostratus rankNimbostratus
May 30, 2014

apm sso inline javascript

Hi all,

 

I'm trying to implement APM+SSO (form-based client-initiated) on a web-application. The form detection seems to work fine, because I can see injected Javascript in the page source on client's browser, but I always get an error message "Content Security Policy: The page's settings blocked the loading of a resource: An attempt to execute inline scripts has been blocked" in Firefox or similar message in Google Chrome. The result is, that the normal form is displayed.

 

I configured the policy with this guide: apm-authentication-single-sign-on-11-5-0

 

Any hints how I can resolve this issue?

 

Many thanks, Philipp

 

BIG-IP Access Policy Manager (APM)
security

5 Replies

  • kunjan_118660's avatar
    kunjan_118660
    Icon for Cumulonimbus rankCumulonimbus
    May 30, 2014

    For Firefox, you can disable content security policy.. of course it brings down the security.

     

     

    In address bar, type about:config and search for security.mixed_content.block_active_content. Double-click it and change its value to false.

     

     

    Or you can try Form based SSO, instead of the client initiated Form SSO.

     

    • Philipp_Stadler's avatar
      Philipp_Stadler
      Icon for Nimbostratus rankNimbostratus
      Jun 02, 2014
      I already tried form based SSO, but I could catch the logon form by URI, with client-initiated form-based I did it by header field (Referrer), which worked ok. I think turning of security isn't a way to go for a public application. regards, Philipp
  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    May 30, 2014

    For Firefox, you can disable content security policy.. of course it brings down the security.

     

     

    In address bar, type about:config and search for security.mixed_content.block_active_content. Double-click it and change its value to false.

     

     

    Or you can try Form based SSO, instead of the client initiated Form SSO.

     

    • Philipp_Stadler's avatar
      Philipp_Stadler
      Icon for Nimbostratus rankNimbostratus
      Jun 02, 2014
      I already tried form based SSO, but I could catch the logon form by URI, with client-initiated form-based I did it by header field (Referrer), which worked ok. I think turning of security isn't a way to go for a public application. regards, Philipp
  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Jun 27, 2014

    I've just run into the same issue with APM+SSO and it's due to CSP (Content Security Policy). The application is sending a header that specifies where different things are allowed to be loaded from, like scripts, style sheets, fonts, and images). Newer, compliant browsers will interpret that header and depending on the settings, will disable inline javascript, which is how the APM adds if forms sso.

     

    In order to fix this, you'll need to either modify the CSP directive for the application, or you can modify it through an iRule. See the following sites for more information on what CSP is and does. Unless the F5 engineers can update the APM SSO to use javascript files for the SSO stuff, this issue may become more prevalent over time with the standardization of HTML5 applications.

     

    • http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    • http://www.cspplayground.com/home

    Hope this helps.