APM: Strip off path from Landing URI

Question

Hi,
Currently I'm working on an APM-Policy and I'm facing an issue with a temporary URI.
Scenario: I want to implement different Sign-On-Methods and an error-fallback for a failed login.
So the idea is to have a landing-URI, with branches for /ad , /google and a fallback to an error-login-page with /error.
If I connect to test.com/ad - the Logon-Page for AD-Authentication should appear (username/pw). If I connect to test.com/google - Logon-Page for 2-Factor should appear (username/pw/googleauthcode). If I enter the wrong code, I should be redirected to test.com/error and get another 2F-logon page with a customized text (wrong code) and again the 3 fields for authentication.
Now, if I use the default "Allow"-Ending in the policy editor, the URL that is forwarded to the webserver is test.com/ad, which causes a 404 error. So the best thing would be to strip off the path after the landing page. I tried to achieve this with an iRule-event, but it doesn't work as expected.
Here's my Policy and the iRule : 
when ACCESS_POLICY_AGENT_EVENT {
 if { [ACCESS::policy agent_id] eq "strip_off_path" } {
   if { [string tolower [HTTP::uri]] starts_with "/ad" } { 
     HTTP::uri "/" 
   } elseif { [string tolower [HTTP::uri]] starts_with "/error" } {
         HTTP::uri "/" 
   } else { 
   }
  }
}
Any ideas? Is it possible to strip off the HTTP::uri with an alternative ending in the policy itself (without iRule)? If I use a redirect-ending to "https://%{session.server.network.name}" I get back to the 2F-Logon-Page again (Landing URI fallback)
Thanks &amp; BR

leonardo_souza · Answer

The iRule you have should work.&nbsp;
Can you put some logs in the iRule and check what happens?
We want to check if the iRule is triggered, also the URI before and after the change.&nbsp;
Also, I would suggest you to use the HTTP::path, as that is a subset of the URI, so smaller and consequently more efficient.
Anyway, they idea continue to be the same.&nbsp;
https://devcentral.f5.com/wiki/irules.http__path.ashx&nbsp;

stan_piron · Answer

Hi,
HTTP::uri and HTTP::path doesn't work in Policy evaluation (except if in clientless mode). during policy evaluation, uri is always /my.policy.
if you want to evaluate landing uri (URI the user entered before redirecting to /my.policy), you can work with this irule:
&nbsp;
when ACCESS_SESSION_STARTED {
    switch -glob -- [set landinguri [ACCESS::session data get session.server.landinguri]] {
        "/ad/*" {
            log local0. "Path before iRule: $landinguri"
            set newlandinguri [string map -nocase {"/ad/" "/"} $landinguri]
            ACCESS::session data set session.server.landinguri $newlandinguri
            log local0. "Path after iRule: $newlandinguri"
            log local0. "Logon type iRule: ad"
            ACCESS::session data set session.custom.logontype "ad"
        }
        "/error/*" {
            log local0. "Path before iRule: $landinguri"
            set newlandinguri [string map -nocase {"/error/" "/"} $landinguri]
            ACCESS::session data set session.server.landinguri $newlandinguri
            log local0. "Path after iRule: $newlandinguri"
            log local0. "Logon type iRule: error"
            ACCESS::session data set session.custom.logontype "error"
        }
    }
}

&nbsp;
this irule raise before VPE evaluation and you can then replace landinguri box with a box using branches:
&nbsp;
ad : expr {[mcget {session.custom.logontype}] equals "ad"}

error : expr {[mcget {session.custom.logontype}] equals "error"}

&nbsp;
if you want to rewrite all requests starting with /ad/ and /error/, you can use this irule (raise after HTTP_REQUEST and for all requests allowed by APM, you can use this irule:
&nbsp;
when ACCESS_ACL_ALLOWED {

switch -glob -- [set uri [HTTP::uri]] {
        "/ad/*" {
            log local0. "Path before iRule: $uri"
            set newuri [string map -nocase {"/ad/" "/"} $uri]
            HTTP::uri $newuri
            log local0. "Path after iRule: $newuri"
        }
        "/error/*" {
            log local0. "Path before iRule: $uri"
            set newuri [string map -nocase {"/error/" "/"} $uri]
            HTTP::uri $newuri
            log local0. "Path after iRule: $newuri"
        }
    }
}

&nbsp;

Forum Discussion

AppWorld Berlin 2026 – iRules Contest Winning Results

One Quick Step to Make your website AI-Agent/MCP Ready with an iRule

IPv8 Would Fix My Routing Tables. It Will Never Ship.

Recent Discussions

f5 r5600 appliance issue with adding trunk to vlan

SSL Forward Proxy, iRules and Client Hello

Errors with AS3 3.56.0 with F5 17.5.1.6

F5 ASM/AWAF – violations logged but no learning suggestions generated

F5 VELOS Backplane Inter-Tenants Communication

Related Content

Two URL Landing pages for APM

How to Preserve APM landing URI

Embedding APM Protected Resources into Third-Party Sites

Landing URI Branch Rule

APM variable assign examples