Forum Discussion
Basic-auth (401) without redirection to /my.policy
Hi,
We use our Bigip like a reverse-proxy with iRules "ProxyPass".
We are in v11
We need to authenticate our users with basic-auth method (HTTP code 401).
The problem is that APM returns a redirect (code 302) to /my.policy, and this is not support by some clients applications.
Do you have an idea (iRules?) to avoid this redirection?
Thank you in advance!
- Ferg_104721NimbostratusHi
- Michel_Lepage_5NimbostratusHi David
- Kevin_StewartEmployeeThis is a fairly common issue with SharePoint. The problem lies in the fact that 1) APM, by default, uses session-based (in browser memory) cookies to maintain session state with the client browser, and 2) the applications that SharePoint spawns (Office apps, WebDAV, some others) can't access that cookie. So anything coming from that application looks like a new session to APM (and get's the initial 302 to /my.policy). The recommended solution is to use persistent session cookies in APM. It's a checkbox on the second tab of an access policy. This allows the APM cookie to be file-based and now accessible to the spawned applications. The expiration of that cookie is controlled by the settings on the first tab, and the value is rewritten on every APM response so that it accurately expires the ticket after a defined amount of idle time.
Hello David,
I dont know if you still have this problem, but i manage to solve it with this iRule i get from DevCentral, you just need to use this iRule with the Normal Auth box on your Access policy.
Code when HTTP_REQUEST { set apmsessionid [HTTP::cookie value MRHSession] if { [HTTP::cookie exists "MRHSession"] } {set apmstatus [ACCESS::session exists -state_allow $apmsessionid]} else {set apmstatus 0} if { !($apmstatus)} { if { [ string match -nocase {basic *} [HTTP::header Authorization] ] == 1 } { set clientless(insert_mode) 1 set clientless(username) [ string tolower [HTTP::username] ] set clientless(password) [HTTP::password] binary scan [md5 "$clientless(password)"] H* clientless(hash) set user_key "$clientless(username).$clientless(hash)" set clientless(cookie_list) [ ACCESS::user getsid $user_key ] if { [ llength $clientless(cookie_list) ] != 0 } { set clientless(cookie) [ ACCESS::user getkey [ lindex $clientless(cookie_list) 0 ] ] if { $clientless(cookie) != "" } { HTTP::cookie insert name MRHSession value $clientless(cookie) set clientless(insert_mode) 0 } } if { $clientless(insert_mode) } { HTTP::header insert "clientless-mode" 1 HTTP::header insert "username" $clientless(username) HTTP::header insert "password" $clientless(password) } unset clientless } else { HTTP::respond 401 noserver WWW-Authenticate "Basic realm=\"[HTTP::host] Authentication\"" Set-Cookie "MRHSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/" Connection close return } } } when ACCESS_POLICY_COMPLETED { if { ([ACCESS::policy result] equals "deny") } { set host [ACCESS::session data get "session.network.name"] ACCESS::respond 401 noserver WWW-Authenticate "Basic realm=\"$host Authentication\"" Connection close ACCESS::session remove } }
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com