Forum Discussion

julienb's avatar
julienb
Icon for Nimbostratus rankNimbostratus

Hello,

​

This is the doc I followed : https://support.f5.com/csp/article/K14391041 ; But I changed some settings, for example my client want to use OpenID Connect with it. On apptest.example.com there is just one Access Profile (Per-Session Policy). Like this :

​

When the user connects for the first time and pass it through, it works, but when he has an active session he can't connect to apptest.example.com, I have an error "Secure Connection Failed" ... An error occured during a connection to apptest.example.com. PR_CONNECT_RESET_ERROR

​

The only "workaround" I found for the moment is to delete the active session at the end of the Access Profile (when I redirect the user to the website). But it means that I can't see his session on the F5.

​

PS : I see nothing in the Access Profile logs, so it means (I think) that is related to the Virtual Server and not the Access Profile.

 

Best regards.

Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Mar 29, 2021

Hello,

your answer is quite comprehensive, I will go through it...

Meanwhile, did you do a traffic capture on the F5 or on the client? On the F5 you can decrypt the SSL and you can also log the reset cause. It's definitely worth to investigate the reason for the connection reason.

 

KR

Daniel

  • julienb's avatar
    julienb
    Icon for Nimbostratus rankNimbostratus
    Mar 30, 2021

    Hello and thank you.

     

    I will investigate.

     

    Best regards.

  • Nikoolayy1's avatar
    Nikoolayy1
    Icon for MVP rankMVP
    Mar 30, 2021

    F5 has a great article for this:

     

    https://support.f5.com/csp/article/K06028005

     

     

    Also with httpwatch or fiddler you can check if you see a response but the blowser maybe has issues to show it as it said the the connection is reset by chrome maybe it is not the F5.

     

     

    https://support.f5.com/csp/article/K45654620

     

     

    For OAuth to decode the answer if you think is need I found this tool. I have such tools to decode SAML messages. For Oauth message decode the F5 has an article for such things:

     

     

    https://support.f5.com/csp/article/K35932460

     

    Also this can be used:

     

    https://oauth.tools/