Forum Discussion
Mike_Harpe_6170
Jan 31, 2012Nimbostratus
DoD CAC authentication using IIS through LTM
I am working with developers and SA people to get an app that uses IIS authentication with LTM.
Basic setup is a virtual server on 443 with a cert on the front end, two servers on the back end being load balanced and running SSL/TLS as well. We want to be able to authenticate the users using the cert on the CAC. The app looks at fields in the CAC cert, specifically the CN.
If we put the app on a FastL4 server the authentication works however we don't have persistence and that causes timeouts and other problems.
I have tried everything I can think of and this just refuses to work. I don't have a ton of experience with CACs so I am sure I am missing something.
Any help is appreciated.
Mike Harpe
US Army Human Resources Command
Fort Knox, KY
- mikand_61525NimbostratusI think you can create an IRULE who will copy the necessary data from the clientssl side into the serverssl side. So your IIS-servers will get the proper CN or whatever you need.
- mikand_61525NimbostratusPerhaps these links might help?
- Mike_MaherNimbostratusMike,
- hooleylistCirrostratusIf you can't modify the web app to either disable the client cert requirement or parse the client cert from HTTP request headers, you could use try Proxy SSL. It's a feature added in 11.0 which allows the client and server to negotiate the SSL handshake directly. But once the handshake is complete, TMM can decrypt the SSL and inspect/modify/optimize the decrypted application traffic.
- Mike_MaherNimbostratusSo not to sidebar this conversation but you peaked my interest with the ProxySSL note. So from reading the link you provided, am I correct in assuming if I do this on a system that has ASM licensed that I can still inspect all data with that module?
- hooleylistCirrostratusHi Mike,
- Mike_MaherNimbostratusI am going to be upgrading from 10.2.0 to 11.1 HF1 over the next month or so, and yes I do have an application that I am going to test this for. I will post a new thread and let you all know how it goes.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects