Forum Discussion
navgup_66025
Nimbostratus
Nimbostratusirule to send traffic to correct pool
I have a requirement to send default https request to Kerberos_Pool but if authentication fails (kerberos SSO), fall back to Forms_Pool (form based login). I have tried different methods, including capturing of http header but it seem for some reason TMS is not seeing the value and able to compare it.
when HTTP_RESPONSE {
if { [HTTP::header value Authorization] contains "Negotiate YII" } {
pool Kerberos_Pool
} else {
pool Forms_Pool
}
}
Another method i have tried it, but this requires authentication profile and i am not sure which one to apply (eg: ssl_cc_ldap; ssl_crldp or ssl_ocsp)
when AUTH_RESULT {
if {[AUTH::status] == 0} {
pool Kerberos_Pool
} else {
pool Form_Pool
}
Please advise. thanks
4 Replies
navgup_66025I have also tried this: when AUTH_RESULT {
if {[AUTH::status] != 0} {
pool Form_Pool
} else {
pool Kerberos_Pool
}- Kevin_Stewart
Employee
A few things to consider:
1. Are you referring to Kerberos SSO between APM and the server? And also Forms-based SSO between APM and the server? If so, and Kerberos fails, are you prepared to provide a username and password?
2. The AUTH events belong to the old Advanced Client Authentication (ACA) module and do not apply to APM.
3. If using TWO server side SSO profiles, from 1 above, and you do have a username and password to supply to Forms-based SSO, what you'd necessarily need to do is 1) save the request, 2) capture the Kerberos auth failure (401) in the response, 3) select a new SSO profile using the WEBSSO::select method, and then 4) replay the request.
The above isn't the most intuitive things, so please first elaborate if possible on your requirements. - navgup_66025No APM in the picture.
I have simple logic
when HTTP_REQUEST {
if { [HTTP::header value Authorization] contains "Negotiate YII" } {
pool Kerberos_Pool
} else {
pool Forms_Pool
}
}
However, since there are many REQUESTs and RESPONSEs in the same session, the browser jumps from kerberos pool to forms pool (back and forth) because form pool sometimes return null. Is there a way to set a global variable in irule that keep a count for a number of a request went through? For eg, how many times [HTTP::header value Authorization] contains "Negotiate YII" HTTP REQUEST went through? - Kevin_StewartReference: https://devcentral.f5.com/community/group/aft/2167601/asg/50
