Forum Discussion
Blake_79204
Jan 10, 2012Nimbostratus
iRule/APM Authentication and Authorization with ODBC
Hello, I'm not a developer at all and am pretty much brand new to F5, as well, so if my question is a bit ignorant I apologize in advance. We're converting from our existing authentication scheme to APM, and for the most part it's going well and making sense. We've got the access policy setup for most things to work by looking at LDAP, determining if the user appears there, and then finding out what attributes they have (we have 3 different LDAP instances, here's one example):
Populate and search windowsprod_ldap_memberof
if { $access_session == 1 && $windowsprod_authenticated == 1 } { set windowsprod_ldap_memberof [split [ACCESS::session data get session.ldap./Common/auth_windowsprod_ldap_act_ldap_query_1_ag.attr.memberOf] "\|," ] }
if { $windowsprod_ldap_memberof ne "" } { foreach item $windowsprod_ldap_memberof { set item [string tolower [string trim $item] ]
if { $item ne "" && [lsearch [string tolower $windowsprod_ldap_allow_memberof] $item] >= 0 } {
if { $static::debug == 1 } { log local0. "Found windowsprod memberof role: $item" }
if { $windowsprod_authenticated == 1 } { set user_authorized_for_app 1 } } } }
Then we can compare the groups a person is a memberof with groups allowed access to various apps and make a decision from there.
We have some access requirements that use ODBC and not LDAP.. Ideally, things would work in a similar fashion – user enters username and password and we look to see if they’re there and then look to see what attributes we have so that we can compare those attributes with the allowed attributes per app to say yea or nay. I don’t think we can do the query directly from ODBC. What I can do, though, is get the info from the ODBC connection to an HTTP page as text.
How then, can I use an iRule to read that text and compare with known values in a fashion similar to the LDAP example above?
Any help/feedback would be appreciated.
- Colin_Walker_12Historic F5 AccountWell, if you're already going to have the output on an HTTP page as text, then reading it is relatively easy. iRules has access to the payload of every HTTP response that goes through the box, so all you'd need to do is extract the info you're looking for. There are some good examples of this in the CodeShare, but it's pretty straight-forward.
- Blake_79204NimbostratusAwesome - thank you. I figured it shouldn't be a difficult task, but I didn't know the syntax and was having a hard time finding it. I'll spend some time going through the links you provided, but based on your description that's exactly what I need.
- Colin_Walker_12Historic F5 AccountSure thing, I hope it helps.
- Blake_79204NimbostratusOK - making progress, but still stumped on an aspect of this.
- Blake_79204NimbostratusiRule love webcast makes me think I need to investigate sideband connections for this....
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects