For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sajid's avatar
Sajid
Icon for Cirrostratus rankCirrostratus
Sep 15, 2019
Solved

External Posting to APM with dynamic URL

Hi Guys,   I have a requirement to pass url with username/password.   Simple username/password working fine, when trying to pass the url as variable. It maks password empty.   Working sol...
application delivery
BIG-IP Access Policy Manager (APM)
security
  • youssef1's avatar
    youssef1
    Sep 16, 2019

    Hi Sajid,

    In fact we have to decoded payload using "[URI::decode [HTTP::payload]]"

    Payload:

    is=txtURL=https%3A%2F%2Ftrnapp01.example.com%3A443%2Fappmanager%2Fabc&username=user123&password=%40password123

    decoded raw:

    is=txtURL=https://trnapp01.example.com:443/appmanager/abc&username=user123&password=@password123

    now we have to set the right regex in your irule:

    https://regex101.com/

    when HTTP_REQUEST_DATA {
 
set payload [URI::decode [HTTP::payload]]
 
set username [URI::query "?[HTTP::payload]" username]
set password [URI::query [URI::decode "?[HTTP::payload]"] password]
 
regexp {^.*txtURL=([^&]+).*$} $payload -> gotURL
 
log local0. "Username: $username - password : $password - gotURL: $gotURL"
 
HTTP::release
 
}

    keep me in touch.

    regards

Sajid's avatar
Sajid
Icon for Cirrostratus rankCirrostratus
Sep 16, 2019

 

Got this message (log local0)

 

Sep 16 19:13:22 B01 info tmm1[24290]: Rule /Common/iRule_APM_Ext_SAMLtAuth <HTTP_REQUEST_DATA>: ****txtURL:0 ***username:user123 ***password: and payload is=txtURL=https%3A%2F%2Ftrnapp01.example.com%3A443%2Fappmanager%2Fabc&username=user123&password=%40password123

 

from iRule

when HTTP_REQUEST_DATA {

  set payload [HTTP::payload]

set username [URI::query "?[HTTP::payload]" username]

set password [URI::query [URI::decode "?[HTTP::payload]"] password]

set gotURL [regexp {^.*name=\"txtURL\" value=\"([^\"]+).*$} $payload -> txtURL]

log local0. "****txtURL:$banner9url ***username:$username ***password:$password and payload is=$payload"

HTTP::release

}

 

I think URL decode required.