Forum Discussion
Member_9894
Nimbostratus
NimbostratusLogin Banner
Hello.I've been tasked to create a login banner that will pop up when an external user hits my LTM and goes to any of my virtual servers. It's supposed to consist of a short message explaining that use of the system constitutes consent to monitoring and should have one button (yes/ok etc.) and the small x in the corner that would allow them to cancel out of the pop up (ideally this should close their connection or send them to an errorpage.) I believe this is possible with an iRule, but I have no experience with TCL. I would greatly appreciate any suggestions and help that anyone has to offer. Thanks in advance.
hooleylistCirrostratus
Hi Javern,
What protocol are you load balancing through LTM? For HTTP, you could use a stream profile to inject Javascript which creates a popup in responses. We've discussed this type of response content injection in a few recent posts:
http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/1171990/afv/topic/Default.aspx
http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/29379/afv/topic/Default.aspx
http://devcentral.f5.com/Default.aspx?tabid=53&aff=5&aft=1144860&afv=topic&afpgj=1
Aaron
Member_9894We are using HTTPS. I'll check out those threads, thank you.
Reiss_79688Hello,
I'm working with Member 9894 on this project.
What we are attempting to accomplish is present our users with a banner that says 'you are accessing our servers; you consent to monitoring, blah blah blah' and have them click on the 'OK' button to access the content.
Here's our basic setup...
multiple VS accessed via https...using PKI/CAC for client authentication.
using Big IP LTM v9.3.0
We would like to have Big IP serve the 'banner' page prior to the users being authenticated for any of our VSs.
I have attempted to use a 'HTTP::respond 200 content [subst $::html_data]'. I can get the page (basic html with embedded css) to be served but when clicking on the 'OK' button I'm not sure what happens at that point.
Any help would be appreciated.
I can post iRule scripting if needed; let me know.
- hooleylistIt should be relatively simple to implement a Javascript injection in responses. I think the trick is to figure out what code you want to inject and under which circumstances. For example, if this was the HTML for your index page:
My test index page This is the rest of the HTML in the body...
You could use a stream profile and STREAM::expression based iRule to replace < body > with < body > < script >alert('Click ok to access the page')< /script >:My test index page This is the rest of the HTML in the body...
If you wanted to serve a page instead of Javascript, you could use logic like has been done in the maintenance page Codeshare examples. On any request (or any request to a login page), check for a cookie which the iRule sets upon clicking okay in a form. If the cookie is not set, redirect the client to /tos.html or some other page which is served from the iRule. On requests to that page, you send back the HTML for a banner page with an Accept button. The form action could be the same URI with a query string parameter set like /tos.html?accept=1. On requests to /tos.html?accept=1, you could redirect to the login page or the originally requested page and set a cookie indicating acceptable of the terms of service.
Here are links to the maintenance page examples:
http://devcentral.f5.com/wiki/default.aspx/iRules/LTMMaintenancePageGenerator.html
http://devcentral.f5.com/wiki/default.aspx/iRules/LTMMaintenancePage.html
http://devcentral.f5.com/wiki/default.aspx/iRules/Automatic_maintenance_page___Sorry_page_with_images.html
Aaron - Reiss_79688
Thanks Aaron. Very good info. I was heading down those lines, but how do I get the iRule to capture the button click on my html page delivered to the user?
Here is a snippet of what I have for the html on my tos.html page.I Agree
This just seems to bring me back to the tos.html page.Also, the only way that I can see (with my limited knowledge of the Big IP traffic flow sequence and when the events are called) to do it is to have the iRule set a variable or cookie in the same conditional statement as the HTTP::respond. By doing this, though, the user won't actually have to click the 'I Agree' button to have the cookie or variable be set, instead, all they would have to do is visit the page. I would much rather know that they clicked the 'I Agree' button.
Here is some of the iRule:
when CLIENT_ACCEPTED { set consent_monitor "NotAgree" log local0. "CLIENT_ACCEPTED" } when HTTP_REQUEST { if { $consent_monitor == "NotAgree" } { log local0. "Client has not agreed to monitoring. Sending consent page..." set origUrl "[HTTP::host][HTTP::uri]" log local0. "original URL = $origUrl" HTTP::respond 200 content [subst $::html_data] set consent_monitor "Agree" } }
Any thoughts?...clear as mudd? Reiss - Reiss_79688sorry about the format of my last post...i seem to be having trouble with the "code" section.
- hooleylistHi Reiss,
Can you attach the HTML as a text file to your post and remove it from the written part of the post? Or you might be able to put it in a [ code ] [/ code ] block to get the HTML to render inline.
Thanks,
Aaron 
Al_3585Reiss were you ever able to complete your login banner project? We have a similar need and would like to use it if you got it working. Trying not to "re-invent the wheel". Thx!