Create Domino LTPA token on F5 problem

Hi all,

have you got any news about this bug? I'd like to implement an iRule to generate LtpaToken in order to integrate new apps with legacy applications that are running on a mainframe, if there is a new version of this iRule could you please share it with the community?

We're running 16.1.4.2

Thank you all

Cristian

Hi Team. Anyone have this working still? We are running BIG-IP 11.3.0, Domino 8.5.2, and I am struggling to get the code to produce a valid encoded token. Can anyone share an example of the set ltpa_secret "b64encodedsecretkey" field, to give me a clue to what this should look like? Is this a direct copy out of the LTPA document in Domino LTPA_DominoSecret field, or do I need to change that value prior to insert into the iRule? Thanks in advance!

Hi,

i stay in front of the same challenge like jeff and try to implement LTPA token creation incl. Reverse Proxy with SSO. This is all new for me. We use 10.2.2 @ LTM incl. ASM.

So, if i try to create an irule with Jeff's code from above i get an syntax validation error in Irule editor:

Create binary formatted token.

set ltpa_token_raw_bin [binary a* $ltpa_token_raw]

--> [invalid option "a*" must be: format scan] [a*]

so for me, it looks like the line should be replaced by this:

set ltpa_token_raw_bin [binary fromat a* $ltpa_token_raw]

can someone confirm that behaviour?

Thx

  Create binary formatted token.
 set ltpa_token_raw_bin [binary a* $ltpa_token_raw]

when RULE_INIT {
 set ::DEBUG 0
 set cookie_name "LtpaToken"
 set ltpa_version "\x00\x01\x02\x03"
 set ltpa_secret "b64encodedsecretkey"
 set ltpa_timeout "1800"
}

when HTTP_REQUEST {
 
  Do your usual F5 HTTP authentication here
 

  Initial values
 set now [clock seconds]
 set creation_time_temp [expr { $now }]
 set creation_time [format %X $creation_time_temp]
 set expr_time_temp [expr { $creation_time_temp + $::ltpa_timeout}]
 set expr_time [format %X $expr_time_temp]
 set username [HTTP::header "username"]
 set ltpa_secret_decode [b64decode $::ltpa_secret]

  First part of token
 set cookie_data_raw {}
 append cookie_data_raw $::ltpa_version
 append cookie_data_raw $creation_time
 append cookie_data_raw $expr_time
 append cookie_data_raw $username
 append cookie_data_raw $ltpa_secret_decode

  SHA1 of first part of token
 set sha_cookie_raw [sha1 $cookie_data_raw]

  Final not yet encoded token
 set ltpa_token_raw {}
 append ltpa_token_raw $::ltpa_version
 append ltpa_token_raw $creation_time
 append ltpa_token_raw $expr_time
 append ltpa_token_raw $username
 append ltpa_token_raw $sha_cookie_raw

  Create binary formatted token.
 set ltpa_token_raw_bin [binary a* $ltpa_token_raw]

  Final Base64 encoded token
 set ltpa_token_final [b64encode $ltpa_token_raw_bin]

  Insert the cookie
 HTTP::cookie insert name $::cookie_name value $ltpa_token_final


  Loop through the list of Cookie headers to remove
  superfluous trailing semi-colons (known F5 issue)
  if they exist.
  
  Save the Cookie headers to a TCL list
 set cookie_headers [HTTP::header values "Cookie"]

 foreach cookie_header $cookie_headers {
    Check if the last character is a semi-colon
   if {[string range $cookie_header end end] eq ";"}{
     HTTP::cookie remove LtpaToken
      Insert the header without the semi-colon
     HTTP::header insert Cookie [string range $cookie_header 0 end-1]
     } else {
      Insert the original header
     HTTP::header insert Cookie $cookie_header
     }
   }
   
  Remove Authorization HTTP header to avoid using basic authentication
 if { [HTTP::header exists "Authorization"] } {
 HTTP::header remove "Authorization"
 }

 if {$::DEBUG} {
   binary scan $ltpa_token_raw H* ltpa_token_raw_hex
   log local0.debug "LTP_TOKEN raw Hex: $ltpa_token_raw_hex"
   binary scan $ltpa_token_raw H* ltpa_token_raw_hex_bin
   log local0.debug "LTP_TOKEN raw_bin Hex: $ltpa_token_raw_hex_bin"   
   set ltpa_final_decoded [b64decode $ltpa_token_final]
   binary scan $ltpa_final_decoded H* ltpa_final_decoded_hex
   log local0.debug "LTP_TOKEN decoded Hex: $ltpa_final_decoded_hex"
 }
}

rule irule03a {
   when RULE_INIT {

 set hello "Hello World"

 log local0. "WITH leading \\x00"
 set prefix "\x00\x01\x02\x03"

 log local0. "WITHOUT leading \\x00"
 set prefix "\x01\x02\x03"

 set text "${prefix}${hello}"

 log local0. "WITHOUT concatenation"
 set text "\x00\x01\x02\x03HelloWorld"

 set text_enc [b64encode $text]
 set text_dec [b64decode $text_enc]
 binary scan $text H* text_hex
 binary scan $text_enc H* text_enc_hex
 binary scan $text_dec H* text_dec_hex

 log local0. "Text: $text"
 log local0. "Text hex: $text_hex"
 log local0. "Text encoded: $text_enc_hex"
 log local0. "Text decoded: $text_dec_hex"

}
}