Forum Discussion

jbb_41358's avatar
jbb_41358
Icon for Nimbostratus rankNimbostratus
May 07, 2012

how to emulate webseal junctions in iRules

Hi,   Could someone point me to appropriate resources that would allow us to figure out how to read Webseal junction definition config files so as to generate corresponding pool definitions to be u...
ibm
partner
amass87_221296's avatar
amass87_221296
Icon for Nimbostratus rankNimbostratus
Mar 15, 2017

Wow, old thread.

 

I am finishing up a project where I had to replace TAM Webseal junctions with F5. The biggest challenge is that the URI is constantly changing, so a simple iRule based on URI won't work to proxy a users subsequent connections after the intial connection. This could probably be improved on. However, what ended up working was this:

 

  1. create new hostnames and DNS entries for every junction, and point them all at the same IP address.

     

  2. create a virtual server and pool for every junction (regardless if only 1 pool member)

     

  3. single virtual server front-end with iRule

     

  4. first pass through front-end virtual server, match /URI and 301 Location to corresponding hostname

     

  5. subsequent passes, ignore URI logic (because hostname is different) and proxy using virtual statement based onhostname

     

  6. APM Policy created based on authentication type and applied to each virtual server (junction replacement)

     

There were some shortcomings to this approach, and the F5 certainly doesn't handle everything the exact same way. We had issues with authentication on iFrames. TAM just sent a pop-up box, but the F5 login page won't display within a frame and breaking out of the frame was not desirable. We also had some basic pains with redirection.

 

At the end of the day I was just glad to get as far as we got. Would be interested to hear of anyone else who has attempted to replace Webseal with F5 APM.