For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wompi_203183's avatar
Wompi_203183
Icon for Nimbostratus rankNimbostratus
Apr 20, 2016
Solved

Exchange ActiveSync published via APM, client certificates and kerberos sso mixes up kerberos tickets

Hi,   we have published Exchange ActiveSync via F5 APM for mobile clients (Iphone) with client certificates. The clients are managed with air watch mdm and have installed a certificate for authent...
BIG-IP Access Policy Manager (APM)
LTM
security
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Apr 23, 2016

    Hello,

     

    It's an issue viewed since latest version of BIG-IP. It's now safer to deploy Active Sync using the available iApp for Exchange.

     

    You should not use the following irule anymore : _sys_APM_activesync

     

Yann_Desmarest's avatar
Yann_Desmarest
Icon for Cirrus rankCirrus
Apr 23, 2016

Hello,

 

It's an issue viewed since latest version of BIG-IP. It's now safer to deploy Active Sync using the available iApp for Exchange.

 

You should not use the following irule anymore : _sys_APM_activesync

 

Wompi_203183's avatar
Wompi_203183
Icon for Nimbostratus rankNimbostratus
May 06, 2016
Hi, I tried the iapp but this didn't work either. APM threw the following error because of the iphone option header: (null):Common:00000000: Access encountered error: ERR_ARG. File: ../modules/hudfilter/access/access.c, Function: hud_access_handler, Line: 2525 2016-04-25 10:05:16 But I replaced the old irule with _sys_APM_ExchangeSupport_OA_BasicAuth and now it seems to work. The only drawback is that the first time the users get a basic auth window and have to enter anything. Afterwards the kerberos SSO auth with certificate takes place. Subsequent requests work fine. I haven't found the time yet to look into the irule to see if I can comment out the 401 basic auth. Thank you Best regards Mark