For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

farbrorbarbro's avatar
farbrorbarbro
Icon for Nimbostratus rankNimbostratus
Jul 02, 2019

oAuth client request over http

Hello.

I have followed the guide https://f5-agility-labs-iam.readthedocs.io/en/latest/class2/module1/module1.html#task-6-linkedin-custom-provider for creating a social media login.

It always fail when APM oauth client POST's to accessToken.

In ssldump i can see that the request is made over HTTP and not HTTPS even though i have configured HTTPS in my provider settings.

 

In bigip.conf everything seems to be correct:

grep -i "www.linkedin" /config/bigip.conf

  authentication-uri https://www.linkedin.com/oauth/v2/authorization

  token-uri https://www.linkedin.com/oauth/v2/accessToken

  token-validation-scope-uri https://www.linkedin.com/v1/people/~

 

Example request. (Note the HTTP in the POST)

GET /oauth/client/redirect?code=ABC123

 

POST http://www.linkedin.com:443/oauth/v2/accessToken HTTP/1.1

Host: www.linkedin.com:443

User-Agent: F5 OAuth Client

...

 

Any ideas from you guys on what i might have missed?

No RepliesBe the first to reply