Automatic LDAP Login

Hi there,

 

 

Considering the Referer header can easily be forged, I wouldn't suggest using such a methodology. If you can safely assume that if a person made a successful request to one page they can then access the other areas, you could define the required pages and then insert a cookie with an encrypted or random token as the value. On requests to the other areas where you want to insert the credentials, you could validate the cookie exists and then allow access.

 

 

You can define the URIs in a datagroup (called a class in the bigip.conf) and then check the requested URI using matchclass. If the criteria for allowing access to the restricted URIs is met, you can insert a cookie in the response using HTTP::cookie in the HTTP_RESPONSE event. You can generate the token using the HTTP::cookie encrypt or rand functions. If you used rand, you'd need to insert the token in the session table so you could validate subsequent requests.

 

 

If it's a specific group of users that need to use the http://username:password@website syntax, could you just tell them to type in the user/pass when they get a 401 prompt? Or could they make a registry change to re-enable this syntax (Click here)? Or are these users coming from a static IP range? If so, you could insert the credentials based on client IP address.

 

 

Aaron