[HELP PLEASE!] Client Certificate Validation based on URI
Hello!
I need help making an iRule that does the following:
1 - if the request goes to "/auth" the client's certificate is not validated, but when BIG-IP forwards a request to the API server in the pool, that API server will validate the serverssl profile (mTLS) certificate.
2 - any other request "/", the client's certificate will be validated and if it is not in the "trusted certificate authorities", the request will be answered with 403. If the certificate is validated, the request will be forwarded to the API server, which will validate the serverssl profile certificate.
I found out another iRule similar to the one I need but when I do the request to URI /auth, there's no browser pop-up to select the cliente certificate.
when CLIENT_ACCEPTED {
set session_flag 0
}
when CLIENTSSL_HANDSHAKE {
if { [SSL::cert count] != 0 } {
log "Client cert is OK; releasing HTTP request."
HTTP::release
}
}
when HTTP_REQUEST {
if { ![HTTP::uri] starts_with "/auth" } {
log "Certificate required for: [HTTP::uri]"
if { [SSL::cert count] == 0} {
log "No cert found. Holding HTTP request until a client cert is presented..."
HTTP::collect
set session_flag 1
SSL::authenticate always
SSL::authenticate depth 9
SSL::cert mode require
SSL::renegotiate
}
}
else {
log "No certificate needed for: [HTTP::uri]"
}
}
Can someone help, please?
Thanks