For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Michael_65398's avatar
Michael_65398
Icon for Nimbostratus rankNimbostratus
Feb 05, 2013

how to bring up a start URI after APM full webtop login?

hi there,

 

 

when user logs into APM, if full webtop is configured, user will go to https://www.example.com/webtop.eui?webtop=/Common/My_Webtop&webtop_type=webtop_full which list out the resources user is entitled to use.

 

 

is there a way to redirect user to a static web page instead of the full webtop page without killing the secure connection? i tried a few methods and none worked:

 

 

1. if i use a redirect ending in VPE, the redirect kills the remote session and user can not browse back to https://www.example.com/webtop.eui?webtop=/Common/My_Webtop&webtop_type=webtop_full to see the full webtop again

 

2. if i use HTTP:redirect in an irule "when HTTP_REQUEST { ... if uri starts with /webtop.eui?webtop=/Common/My_Webtop... ", the irule will not get triggered (it looks like APM webtop does not trigger HTTP_REQUEST event

 

3. if i user HTTP:redirect in an irule "ACCESS_SESSION_STARTED" event, it does not seem to work

 

 

pulling my hair out, any suggestion is greatly appreciated

 

 

thanks

 

6 Replies

  • thanks for the reply. exactly how do i do that?

     

     

    are you refering using APM advance customization and embed another HTML page inside the existing full webtop page?

     

     

    thanks

     

  • First another question. I gathered from another post that this is for a landing page. If that's the case, would the landing page come before the webtop and then link to the webtop?

     

     

  • oh, you must be referring to adding a message box after the resource assign in the VPE and instead of displaying a simple message, i could display complex HTML code.

     

     

    the problem with that is: the landing page has multiple internal links which are translated by APM is the landing page is configured as portal access resource. if i just copy the HTML code into the message box, the links won't be translated by APM. if i use the already translated equivalent of the internal links (ie, [domain]/f5-w-xxxxx/index.html), these links will kill my currently user remote session

     

     

    is there a way the get around that?

     

     

    thanks
  • Posted By Kevin Stewart on 02/05/2013 08:02 PM

     

    First another question. I gathered from another post that this is for a landing page. If that's the case, would the landing page come before the webtop and then link to the webtop?

     

     

    yes. this landing page comes before the full webtop.

     

     

    so basically the scenario i am trying to accomplish is this: there is a intranet landing page (e.g. landingpage.company.com) that all user should see after loggin into APM. and depends on the user's AD group, there is different resources such as portal access/remote desktop and so on available to that users.

     

     

    because when a user logs into APM, he only gets either a portal access webtop or full webtop, i have a problem:

     

    if i configure the intranet landing page landingpage.company.com as the portal access webtop, user would not have access to different resources depending on AD group memebership.

     

    if i configure a full webtop and assign that to the user after login, user will only see the full webtop listing all the resources he is entitiled to but he can not see landingpage.company.com

     

     

    this is why i am trying to find a way to redirect user from the full webtop to landingpage.company.com after loggin in.

     

     

    so far i have not been been to do that after trying a number of approaches including writing irules.

     

     

    would greatly appreciate any suggestions...

     

     

    thanks

     

  • I've worked all morning and came up with this iRule

    when ACCESS_POLICY_COMPLETED {
        set sid [ACCESS::session data get "session.user.sessionid"]
        log accesscontrol.local1.notice "01490000:7: $sid: ---Event ACCESS_POLICY_COMPLETED Fired---"
    
        switch [ACCESS::session data get "session.policy.result"] {
            "allow" {
                if { [ACCESS::session data get session.assigned.webtop] starts_with "/Common/" } {
                    ACCESS::respond 302 Location "[ACCESS::session data get session.server.network.protocol]://[ACCESS::session data get session.server.network.name][ACCESS::session data get session.server.landinguri]"
            }
        }
    }