For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

NoamRotter_1534's avatar
NoamRotter_1534
Icon for Nimbostratus rankNimbostratus
Jan 15, 2017

Calling access profile from VPE

I have a general access profile with default settings that assigns pools based on URI in the VPE:

 

/uri1 = app1

 

/uri2 = app2

 

 

Now, I want that /uri3 will have a different access profile with customized Settings like

 

"Max Sessions Per User" limit

 

 

basically, the user should hit the default access profile and switch to the customized access profile.

 

Is it possible to switch between access profiles within the VPE?

 

 

Thanks,

 

Noam.

 

application delivery
BIG-IP
BIG-IP Access Policy Manager (APM)
iRules

3 Replies

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 16, 2017

    Hi,

    you can use this irule.

    when ACCESS_POLICY_COMPLETED {
    if {([ACCESS::policy result] equals "allow") && [set maxSession [ ACCESS::session data get session.custom.maxSession ]] } {
        set apm_uuid "[PROFILE::access name].[ACCESS::session data get session.logon.last.username]"
        set apm_cookie_list [ ACCESS::uuid getsid $apm_uuid ]
        if {[llength $apm_cookie_list] > $maxSession} {
            set apm_oldestid [ lindex $apm_cookie_list 0 ]
            ACCESS::session remove -sid $apm_oldestid
        }    
    }
}

    The max session value must be set in variable 

    session.custom.maxSession

    the irule will have the same behavior as the default option, remove the oldest session with same uuid (username authenticated on the current profile)

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 18, 2017

    Hi,

     

    can you log this value to check if it is the same as variable apm_uuid?

     

    [ACCESS::session data get session.assigned.uuid]

    if it is different, change code with :

     

    set apm_uuid [ACCESS::session data get session.assigned.uuid]