Need to allow request only if application opens from parent portal

Hi,

You can use ASM module to force url access through a specific workflow "URL Flow".

You can use APM and extend the session cookie domain to fit both apps. Then, with an irule, you can check for valid session and grant access or deny/redirect user.

Not sure if this is good in terms of security but you can use an irule to identify the referer and provide a cookie, here is the logic :

when HTTP_REQUEST {
    set insert_cookie 0
    if { !([HTTP::cookie exists MRH]) } {
        reject
    }
    if { [HTTP::header Referer] eq "https://myportal.com/index.html" } {
        set insert_cookie 1
    }
}

when HTTP_RESPONSE {
    if { [info exists insert_cookie] and $insert_cookie == 1 } {
        HTTP::cookie insert MRH value "some verifiable encrypted string"
    }
}

That's the concept, then you should then add some security around the cookie value generation

Hi,

You can use ASM module to force url access through a specific workflow "URL Flow".

You can use APM and extend the session cookie domain to fit both apps. Then, with an irule, you can check for valid session and grant access or deny/redirect user.

Not sure if this is good in terms of security but you can use an irule to identify the referer and provide a cookie, here is the logic :

when HTTP_REQUEST {
    set insert_cookie 0
    if { !([HTTP::cookie exists MRH]) } {
        reject
    }
    if { [HTTP::header Referer] eq "https://myportal.com/index.html" } {
        set insert_cookie 1
    }
}

when HTTP_RESPONSE {
    if { [info exists insert_cookie] and $insert_cookie == 1 } {
        HTTP::cookie insert MRH value "some verifiable encrypted string"
    }
}

That's the concept, then you should then add some security around the cookie value generation

Formatted example :

on VIP1 :

when HTTP_RESPONSE {
    if { [HTTP::cookie exists "MySessionCookie"] } {
        HTTP::cookie domain "MySessionCookie" "example.com"
    }
}

on VIP2 :

when HTTP_REQUEST {
    if { ([HTTP::cookie exists "MySessionCookie"]) } {
         insert code to add cookie validation
    } else {
        HTTP::redirect "https://vip1.example.com/login"
    }
}

But clearly, it would be easier to use APM module and put an access profile with multi-domain sso on both VIP and configure Web SSO for VIP1.

Formatted example :

on VIP1 :

when HTTP_RESPONSE {
    if { [HTTP::cookie exists "MySessionCookie"] } {
        HTTP::cookie domain "MySessionCookie" "example.com"
    }
}

on VIP2 :

when HTTP_REQUEST {
    if { ([HTTP::cookie exists "MySessionCookie"]) } {
         insert code to add cookie validation
    } else {
        HTTP::redirect "https://vip1.example.com/login"
    }
}

But clearly, it would be easier to use APM module and put an access profile with multi-domain sso on both VIP and configure Web SSO for VIP1.