Forum Discussion
NimbostratusF5 APM - HTTP Auth issues with redirecting token.
Issue: We have an application that houses a User Directory Services and we use a HTTP form based auth profile. We set the standard config for this.
Everything looks like its going to work and the auth gets to the server, BUT, what seems like a problem is the Successful Logon Detection Match Value
.:8080/otdsws/login?RFA=PostTicket%3A%3Ahttp%3A%2F%2Fwecma0021..%3A8080%2Fwebaccess%2F%3Fwahash%3D%2523tab%253Dcontent
The idea is that the auth would be sent to wecma0020, a token is received back and redirected to wecma0021 with that token. From the webserver, works great, but when we add this into the APM for successful detection, it just spins. When I look at Managed Sessions with my user id, I get the following:
2016-03-25 11:56:38Username ‘_*@******.com' 2016-03-25 11:57:21Following rule 'fallback' from item 'Message Box(1)' to ending 'Allow' 2016-03-25 11:57:21Access policy result: LTM+APM_Mode 2016-03-25 11:57:22\N: Could not find SSO username, check SSO credential mapping agent setting 2016-03-25 11:57:22\N: SSO username is empty - SSO is disabled 2016-03-25 11:57:23\N: Could not find SSO username, check SSO credential mapping agent setting 2016-03-25 11:57:23\N: SSO username is empty - SSO is disabled
Currently we are using a Kerberos SSO config but started thinking we might need Forms or Form-Client initiated SSO. But don’t know if that is the correct direction or not. Any value would be greatly appreciated.
3 Replies
That error says it can't find your username to send to the form. Do you have a SSO Credentials Mapping object before this one in the VPE? Is sso username being set correctly? Do you see the username being sent correctly to the webserver?
smiley_dba_1116THank you Josiah. Yes, currently, I have it set with Kerberos SSO, but think I have it completely wrong.
And the just of it is that the customer/client can be from any domain. Yahoo, Gmail, etc. So the login wont be in a particular format, other than a email address. Would you recommend using a FORM SSO?
- smiley_dba_1116
The thing that really gets me is that the string during the login process is .:8080/otdsws/login?RFA=PostTicket%3A%3Ahttp%3A%2F%2Fwecma0021...%3A8080%2Fwebaccess%2F%3Fwahash%3D%2523tab%253Dcontent
but then the PostTicket goes to wecma0021.**./webaccess.
I corrected the sso problem with the form client initiate.
The current logging in APM when logging in is:
Mar 25 19:26:17 LOGNDLB01A notice apd[11576]: 01490010:5: b286a27c: Username 'smiley_dba@*********.com' Mar 25 19:26:20 LOGNDLB01A notice apd[11576]: 01490220:5: b286a27c: Pool '/Common/OTDS_DEV.app/OTDS_DEV_pool' assigned Mar 25 19:26:20 LOGNDLB01A notice apd[11576]: 01490005:5: b286a27c: Following rule 'fallback' from item 'Pool Assign' to ending 'Allow' Mar 25 19:26:20 LOGNDLB01A notice apd[11576]: 01490102:5: b286a27c: Access policy result: LTM+APM_Mode
