Forum Discussion

julienb's avatar
julienb
Icon for Nimbostratus rankNimbostratus
Mar 29, 2021

Hello,

​

This is the doc I followed : https://support.f5.com/csp/article/K14391041 ; But I changed some settings, for example my client want to use OpenID Connect with it. On apptest.example.com there is just one Access Profile (Per-Session Policy). Like this :

​

When the user connects for the first time and pass it through, it works, but when he has an active session he can't connect to apptest.example.com, I have an error "Secure Connection Failed" ... An error occured during a connection to apptest.example.com. PR_CONNECT_RESET_ERROR

​

The only "workaround" I found for the moment is to delete the active session at the end of the Access Profile (when I redirect the user to the website). But it means that I can't see his session on the F5.

​

PS : I see nothing in the Access Profile logs, so it means (I think) that is related to the Virtual Server and not the Access Profile.

 

Best regards.

  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Mar 29, 2021

    Hello,

    your answer is quite comprehensive, I will go through it...

    Meanwhile, did you do a traffic capture on the F5 or on the client? On the F5 you can decrypt the SSL and you can also log the reset cause. It's definitely worth to investigate the reason for the connection reason.

     

    KR

    Daniel

    • julienb's avatar
      julienb
      Icon for Nimbostratus rankNimbostratus
      Mar 30, 2021

      Hello and thank you.

       

      I will investigate.

       

      Best regards.

    • Nikoolayy1's avatar
      Nikoolayy1
      Icon for MVP rankMVP
      Mar 30, 2021

      F5 has a great article for this:

       

      https://support.f5.com/csp/article/K06028005

       

       

      Also with httpwatch or fiddler you can check if you see a response but the blowser maybe has issues to show it as it said the the connection is reset by chrome maybe it is not the F5.

       

       

      https://support.f5.com/csp/article/K45654620

       

       

      For OAuth to decode the answer if you think is need I found this tool. I have such tools to decode SAML messages. For Oauth message decode the F5 has an article for such things:

       

       

      https://support.f5.com/csp/article/K35932460

       

      Also this can be used:

       

      https://oauth.tools/