Forum Discussion

mikegray_198028's avatar
mikegray_198028
Icon for Cirrus rankCirrus
Oct 15, 2018

disable client authentication

hello team,

 

We have one vip running with a client ssl profile with client auth enabled. can we disabled client auth based on url using irule?

 

application delivery
BIG-IP
iRules
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 15, 2018

    "URL" as in "URI"?

     

    Is it one VIP servicing multiple hostnames (ex. www1.site.com, www2.site.com, etc.), or one site and multiple URLs (ex. , , etc.)?

     

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Oct 16, 2018

    Hi Mike,

     

    If you use APM you can do IT easly.

     

    First of create your clientssl profile ant set "Client Authentication" --> "Client Certificate" to ignore.

     

    Then in your VPE you can set a policy that trigg "On-Demand Cert Auth" according to the uri (landinguri).

     

    Hope it help you.

     

    regards,

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 16, 2018

    same host name only difference is client authentication enabled on one

     

    It matters because you can't modify an SSL profile (OSI layer 6) on data you receive after decryption (layer 7). If you're switching based on the URI (path), you're only option is to force a renegotiation. You can either do this in a rather complex iRule, or APM can do it naturally using step-up auth: https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-sso-13-0-0/20.html