Forum Discussion

BharatSharda's avatar
BharatSharda
Icon for Altostratus rankAltostratus
Apr 08, 2021
Solved

Insert text to HTTP header via iRule event during APM execution

Hi Community Members, We are trying to insert some text to HTTP header through an iRule which will check for ACCESS_POLICY_AGENT_EVENT generated by via iRule event during an APM checking. Event "...
application delivery
BIG-IP Access Policy Manager (APM)
iRules
  • spalande's avatar
    spalande
    Apr 14, 2021

    HTTP_REQUEST_SEND is also one of the event can be used to send the APM variable.

    https://support.f5.com/csp/article/K74392192

    so worth trying below. modify as needed.

    when ACCESS_POLICY_AGENT_EVENT {
    if { [ACCESS::policy agent_id] eq "event_1" } {
        ACCESS::session data set session.custom.header "value"
        set header [ACCESS::session data get "session.custom.header"]
    }
 }
 
 when HTTP_REQUEST_SEND  {    
    clientside {
    if {[info exists header]}{ 
	HTTP::header insert "headername" $header
    } else {
	 return
	}
   }	
 }
BharatSharda's avatar
BharatSharda
Icon for Altostratus rankAltostratus
Apr 08, 2021

Hi Nikoolayy1,

 

Thank you for your suggestion.

Our expectation is to insert the header when the flow goes through just a certain APM check (branch path) and a certain condition is met, that is because we tried to use ACCESS_POLICY_AGENT_EVENT. Header should not be added by any other APM branch.

 

If we use "ACCESS_POLICY_COMPLETED" or "HTTP_REQUEST" or "ACCESS_ACL_ALLOWED" or even "HTTP_REQUEST", header will be added for all the checks, not just by a specific APM.

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Apr 13, 2021

I think that to set headers or cookies with the event "ACCESS_POLICY_COMPLETED", you need to use the "ACCESS::respond", as I gave in the example in my previous update as "ACCESS_POLICY_COMPLETED" by default does not overide the default APM response after the policy check is completed:

 

Example:

 

https://devcentral.f5.com/s/question/0D71T000006gzth/detail?s1oid=00D00000000hXqv&s1nid=0DB1T0000008Ony&emkind=chatterCommentNotification&s1uid=0051T000008eyBa&emtm=1617222886798&fromEmail=1&s1ext=0

 

 

 

https://clouddocs.f5.com/api/irules/ACCESS_POLICY_COMPLETED.html

 

 

The "ACCESS_ACL_ALLOWED" can be tested as it seems much easy and you can just add a header. So maybe just replace "ACCESS_POLICY_COMPLETED" with "ACCESS_ACL_ALLOWED" on the conbined iRule and if there are issues try "ACCESS::respond" with the event "ACCESS_POLICY_COMPLETED" and enable logs with ''log local0'' to see where is the issues.

 

https://clouddocs.f5.com/api/irules/ACCESS_ACL_ALLOWED.html