Forum Discussion

Peter_Baumann's avatar
Peter_Baumann
Icon for Cirrostratus rankCirrostratus

Hello again,
The customer just told me that with ACA they could validate the provided cert against users cert stored in LDAP.
So, what is missing in the access profile is the ability to check the from the client provided cert with the cert stored at the user in LDAP.

The customer was using a cert validation with ACA if the provided cert is matching the user certs stored in LDAP, even when the user has two valid certs and one of it will soon be invalid because of the expired date.

AubreyKingF5's avatar
AubreyKingF5
Icon for Moderator rankModerator
Nov 21, 2022

Have you used the APM VPE?  I think you can do a simple LDAP search to get the contents of this, but you will need your full DN to set it.

  • Peter_Baumann's avatar
    Peter_Baumann
    Icon for Cirrostratus rankCirrostratus
    Dec 21, 2022

    Hi AubreyKingF5 ,
    It was not possible to use the same features like in ACA.
    The problem is that we only have the action "Client Certificate is valid" but no "Client Certificate is available" like in ACA.

    APM:

    ACA:

    Even with the flexibility of APM we couldn't get to the point to have the same functionality like ACA.
    The only possible way would be to use iRuleLX (NPM) but this would be quite complicated and questionable if it also works with the high traffic volume they have here at the customer.

    • AubreyKingF5's avatar
      AubreyKingF5
      Icon for Moderator rankModerator
      Dec 27, 2022

      Sorry for delay.. I am installing APM now to see if I can show you. It's been a bit since I did this, so there may be some 'new version' rust. 

    • Peter_Baumann's avatar
      Peter_Baumann
      Icon for Cirrostratus rankCirrostratus
      Mar 01, 2023

      Update to this Issue:
      Customer is facing another problem trying to migrate from ACA to APM.
      They have a API behind a VS and APM with Cert Auth. The problem is now that when a machine client is using this API it will check the client certificate (APM On-Demand Cert Auth Block). This will lead to a first redirect to /my.policy which confuses the client with his POST request, the redirect is not done on the client.

      With ACA this was possible since we didn't had the redirect first when checking the cert auth.

      We will now open a case for this at F5 support since migration from ACA to APM is not possible like this.

      Maybe you have some news with your tests on the APM AubreyKingF5 ?