Forum Discussion
Hi Johan,
Do I understand it correctly that the backend server of the first web application (the server hosting x.domain.com) needs to reach y.domain.com in order to gather some information it needs to complete a request for the client?
If so, do you need that backend server to log in to the APM policy, or do you just need it to be able to reach the backend system? If you just need the backend system to gain access to the application, you could put in an agent in the APM policy BEFORE it gets to the login page? This agent can then check if the request is coming from a specific IP, or some other way in which you can identify that it is this server. If so, you can then bypass the login page and go straight through to the "Allow".
Of course, do ensure there is no other way anyone could exploit that ;)
Hope this helps.
- Johan_LångMay 07, 2021Cirrus
Hmm, not quite, I think.
Isnt it the client who makes the acctual call to the backend server, y.domain.com?
x.domain.com responds with a 302 to the client with a new location header and the client trying to make a new request to the new location?
In your scenario, x.domain.com makes the acctual request to y.domain.com in the back, right?
But if there is way to accomplish that instead, im in! :) but im not sure how to do that really..
Best regards,
Johan
- AlexBCTMay 22, 2021Cumulonimbus
Hi Johan,
Sounds like you are a step further at least! (just not with a working solution yet ;)
It sounds to me that there may be some entries missing from the Authentication Domains settings. Can you confirm that the Auth Domains tab looks similar to this one:
Also, in your reponse you mention a redirect to z.example.se - not sure if that is a typo and you mean z.example.COM or if this is a different domain, but either way ensure that this domain is also part of the Auth Domain list.
Let me know how you get on!
- AlexBCTMay 07, 2021Cumulonimbus
Ahyes, that's another way indeed - there are many ways in which you can get multiple components from different sources.
In that case, I think this is what you are looking for: https://techdocs.f5.com/en-us/bigip-14-0-0/big-ip-access-policy-manager-authentication-and-single-sign-on-14-0-0/single-sign-on-and-multi-domain-support.html You can configure the APM policy to be working for multiple domains, but only have a single login. Check under the heading "Configuring an access policy for SSO multi-domain support" for the exact instructions.
Basically you tell the policy to look out for requests for any of the following domains. In your case you configure the multi-domains as x.example.com and y.example.com, with probably x.example.com as your main authentication URL. You then attach the same APM policy to both virtual servers (x. and y.) and let the user go to either one. If the user is not logged in yet and goes to y., they will be redirected to the primary authentication URL (x. in the above example) for login, and then get redirected back to y. for the content. If the user first goes to x., they will log in first, then get redirected by the backend to y., which will check over the session details and allows it through without showing the login page again.
Hope this makes sense (..and works! ;)
- Johan_LångMay 19, 2021Cirrus
Sorry for late reply.
I've already using multidomain. But I use it abit differently.
I got z.example.com as my primary url.
Then Ive added x and y as accepted hostnames in the access policy. With around 20 other urls. All dns-names poiting to the same VS.
You are basically telling me to use another VS and adding the same Access Policy to both of em? Does that even work ?
Regards,
Johan
- Johan_LångMay 07, 2021Cirrus
I can see now that my original question can be interpreted exactly as you did.