Good evening! We are experiencing a security issue with our f5 sharepoint deployment. I have used the iapp f5.microsoft_sharepoint_2010, Software Version is BIG-IP 11.4.1 Build 608.0 Final The problem is that once a browser session is established, it will continue even though the browser is closed and even if the client is rebooted. When I call up the url of the sharepoint it will connect me without asking for authentication. How can I achieve that upon closing the browser the session becomes invalid? Thanks for advice! Alex

Hi, The iApp should have configured a logout URI of "/_layouts/SignOut.aspx" in the APM access profile. 5 seconds after you click logout, the APM session should be killed. If the browser is closed without clicking logout, the session should be killed after 15 minutes. Are these not working for you? thanks Mike

Hi Mike, the logout button is not the problem. When user hits logout, the session terminates. BTW I had to implement an iRule to achieve this: when HTTP_REQUEST { if { [HTTP::uri] contains "/_layouts/SignOut.aspx" }{ HTTP::redirect "https://[HTTP::host]/vdesk/hangup.php3" } } By which setting can I control the 15 minutes timeout you mention? Regards, Alexander

The f5.microsoft_sharepoint_2010 iApp should configure the logout URI automatically for you. No iRule is necessary. Did the template not do that? The session inactivity timeout is set under the Access Profile properties tab.

Maybe I used an older version of the template... Is there no way to force the browser to delete the session upon exit apart from inactivity timeout? Lotus iNotes would kill a session upon browser exit...

APM needs some kind of browser-based event to trigger the deletion. If the browser is closed manually, there's no way to kill the session other than waiting.

f5 sharepoint tenacious session issue

Matthew_Dale_11
Nimbostratus
Dec 16, 2013
Your iRule would be better since it's looking for 'contains' which would match.
Alexander_01_13
Nimbostratus
Dec 16, 2013
Good Idea!

I will submit an RFE.
- Chew_Bacca_1523
  Nimbostratus
  May 14, 2014
  What is the RFE ?
mikeshimkus_111
Historic F5 Account
Dec 16, 2013
There is an existing RFE for wildcard entries in the APM logout URI. Until that is implemented, an iRule is probably the way to go.

Is it feasible to use policy to force deletion of browser cookies upon exit, until APM supports detecting it automatically?
- Alexander_01_13
  Nimbostratus
  Dec 16, 2013
  Hey Mike. How can I use policy to delete the session cookie? Any measure to delete abandoned sessions is welcome! Regards, Alex
mikeshimkus_111
Historic F5 Account
Dec 16, 2013
You can use Group Policy to force deletion of Temporary Internet Files when the broswer is closed. This is located under User Configuration>Policies>Administrative Templates>Windows Components>Internet Explorer>Internet Control Panel>Advanced Page. I believe this should delete the persistent cookies (session cookies are deleted automatically when the browser closes).

This is only going to work if your clients are joined to a domain and using IE.
- Alexander_01_13
  Nimbostratus
  Dec 16, 2013
  Oh, I thought I could enforce the setting on the big ip. Changing group policies would affect only windows machines and only internet explorer and only our own machines, which we believe to be relatively secure. Also there may be users that are used to the cookie persistence and would miss it badly. So, it is no option, I regret.
mikeshimkus_111
Historic F5 Account
Dec 16, 2013
APM does offer client-side enpoint security tools that can delete sessions/temp files when the browser is closed, but AFAIK these are only available when using SSL VPN, and only for IE. Right now, the only way to kill a session after the browser is closed w/o logging out is to use the session inactivity timeout setting.
Matthew_Dale_11
Nimbostratus
Dec 17, 2013
What we need is a proper solution, I'm sure there's more people than just us here that have wanted to run Sharepoint via F5 with the security levels that ISA provided maintained.

F5 support suggested I investigate adding Javascript to Sharepoint which would erase cookies on "onbeforeload" which might be doable but then do you want to modify the application when you know the cookie is set from the F5?

What you'd need is an irule to see if you had any sessions open and if not then delete the Sharepoint specific cookie (Since I dont think you'd be to popular removing all cookies from anyones machine).

If I come up with a solution I'll be sure to post back..
mikeshimkus_111
Historic F5 Account
Dec 17, 2013
We don't have any way to delete cookies from a client machine using an iRule. We can delete APM sessions using iRules, or even return an expired cookie, but we don't have any criteria to differentiate a session from a closed browser vs one that has just been inactive for a bit. That's why you need a client agent of some sort.

If you delete the APM cookie on "onbeforeload", doesn't that leave the cookie in the browser store where it could be used by a different user (this is the way Office apps can use existing sessions to edit documents)?

Wanting to remove all cookies from the machine on exit is pretty common in the public computer/kiosk scenario. I'm assuming that's what we're talking about here, correct? You wouldn't have much need for this on a trusted machine.
- Mathieu_125197
  Nimbostratus
  Jan 10, 2014
  Hello guys, I have the same issue, i have created the irule to delete the session when the browser it's closed but i have a another issue when close the file ( Word, Excel..) , see below the irule: when SERVER_CLOSED { log local0. "Server Connection Closed to [IP::server_addr]." ACCESS::session remove log local0. "TCP Connection Closed to [IP::client_addr]." } But, when i open/editing the file and when close the file, the irule is invoked but drop the global session and the cookie so after i don't have access to the web site. So, have you any update for this case. Regard's
- mikeshimkus_111
  Historic F5 Account
  Jan 10, 2014
  SERVER_CLOSED is triggered when the server-side connection is closed. You wouldn't want to do that for exactly the reason you mentioned. Your browser session shouldn't even stay valid since the APM session is killed every time a back-end connection is closed. I'll ask around about a possible RFE for this, but AFAIK it's not easy to do or even possible w/o the Edge client.
theXfactor82_91
Nimbostratus
Feb 20, 2014
Anybody find a solution to this yet? We are rolling out Sharepoint in the next little while and have come across the same issue.
kj07208_118528
Cirrus
Feb 20, 2014
Thanks this was an awesome discussion I too ran into some of these snags and asked a F5 Engineer to look into this. Also has anyone tried this from other browsers then IE? The office integration is not working for me if another browser of other then IE (I guess because where IE stores the cookies is different then Firefox and Chrome).
Matthew_Dale_11
Nimbostratus
Feb 21, 2014
I believe it only works in IE.

This is true even when not using F5 in my experience (currently through ISA only IE has the office integration, FireFox just downloads the file).