For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tiwang_122270's avatar
tiwang_122270
Icon for Nimbostratus rankNimbostratus
Jan 27, 2014

clientless - sso with machine certificate

hi out there

 

I have build my a server with the machine-certificate agent but since this injects some JavaScript code to the client I need to do it client-less Is there a sample somewhere which shows how I request a given certificate from the machine store? - this Little sample here shows fine how we can run clientless https://devcentral.f5.com/questions/clientless-sso but how do we request a x509 certificate? best regards /ti

 

application delivery
BIG-IP Access Policy Manager (APM)
devops
iRules
security

3 Replies

  • tiwang_122270's avatar
    tiwang_122270
    Icon for Nimbostratus rankNimbostratus
    Feb 10, 2014
    and if I want to run the apm clientless - can this be done? that java code which is injected cannot be executed by the client - or has some a sample of what methodes to initiate under Windows to be able to execute this code on the client?
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 10, 2014

    While anything is possible I suppose, this is one of those agents (like logon forms, message boxes, etc.) that would be extremely difficult to use with clientless-mode. Do you necessarily have to use a machine certificate? Versus a user certificate and standard SSL?

     

  • tiwang's avatar
    tiwang
    Icon for Nimbostratus rankNimbostratus
    Feb 11, 2014

    Hi Kevin Well - since we are using windows pc's to run these batch jobs and if no-one are logged on to it when the batch job is run we can get problems in accessing the user-certificate store we had decided to use the machine store instead. But technically seen we can just as good use the user-store. But the machine cert agent looked perfect to this purpose because we can specify the store there and there is also a branch if the the certificate has been copied so no private keys exist etc - but - if we cannot run this in client-less mode then we must re-consider this. the guide here http://support.f5.com/kb/en-us/solutions/public/12000/100/sol12169 shows simply how to add password-less authentication - just need to have a check on if the certificate has been copied so that no private keys exist (do you know how?). But - looking the other way around and add support for this "java-inject" - are there some samples somewhere on which methods to initiate and objects to make available to be able to handle the script injected by the f5? best regards /ti