Authenticate customer using SSL client certificate or LDAP

Not sure if this is what Colin was getting at or not, but you could assign multiple rules to a vip and pass variables between them. This way you can "simulate" calling multiple iRules using conditions.

 

 

Here's some pseudo code for the three iRules.

 

 

**** rule check_for_client_cert ****
when CLIENTSSL_CLIENTCERT {
  set has_client_cert 1
}
**** rule client_cert_rule ****
when HTTP_REQUEST {
  if { [info exists has_client_cert] } {
     code goes here
  }
}
**** rule ldap_rule ****
when HTTP_REQUEST {
  if { ! [info exists has_client_cert] } {
     code goes here.
  }
}

 

 

In this code, if the CLIENTSSL_CLIENTCERT event is raises, then the variable has_client_cert is set. Then in the HTTP_REQUEST events, you can check whether the variable has been set. The "info exists" command is a builtin TCL command to check whether a variable has been defined.

 

 

Hope this helps...

 

 

-Joe