Forum Discussion

tikshoret's avatar
tikshoret
Icon for Nimbostratus rankNimbostratus
Feb 18, 2015

redircert traffic to a specific resource using HTTP:HEADER

Hi all, maybe you can help me save lots of time in APM version 11.3.0 i need to redirect traffic to a webtop resource base on HTTP Header. i mean that after the user authenticate i need to check if there is specific http header in the request on the same session and direct to a specific webtop resource and if in another request on the same session as before the request doesn't have the same specific header the traffic will flow to other webtop resource. any idea if its possible? any help will be helpful... 10X

 

application delivery
availability
BIG-IP Access Policy Manager (APM)
design
devops
iRules
security

4 Replies

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Feb 18, 2015

    You should be able to do this with an iRule. This is similar to what we've done.

    when HTTP_REQUEST {
    if { [ACCESS::policy result] equals "allow" } {
        if { [HTTP::header exists "HEADER_NAME_1"] } {
             Use ([HTTP::header value "HEADER_NAME_2"] equals "WHAT_YOU'RE_LOOKING_FOR") if you need to check value instead of existence

             This will send a redirect to the user to go to the webtop page. You'll just need to specify the webtop name in the URL
            HTTP::respond 302 Location "/vdesk/webtop.eui?webtop=/Common/WEBTOP_NAME_1&webtop_type=webtop_full"
            return
        } elseif { [HTTP::header exists "HEADER_NAME_2"] } {
             Use ([HTTP::header value "HEADER_NAME_2"] equals "WHAT_YOU'RE_LOOKING_FOR") if you need to check value instead of existence

             This will send a redirect to the user to go to the webtop page. You'll just need to specify the webtop name in the URL
            HTTP::respond 302 Location "/vdesk/webtop.eui?webtop=/Common/WEBTOP_NAME_2&webtop_type=webtop_full"
            return
        }
    }
}

    This will work if the client is already logged in and submits new http request. However, if you're trying to grab the header for right after they authenticate, that's a little more complicated. If you need help with that instead, let me know and I'll help with something a little more robust.

  • tikshoret's avatar
    tikshoret
    Icon for Nimbostratus rankNimbostratus
    Feb 18, 2015

    Hi Michael, thank you for your answer. if i will do something like this: when HTTP_REQUEST { if { [HTTP::header exists "HEADER_NAME"] } { log local0 "HEADER_NAME EXISTS" if {[HTTP::header "HEADER_NAME"] eq "true"}{ ACCESS::session data set session.X.X."HEADER_NAME" true else { log local0. ""HEADER_NAME missing" } } i can use it in the flow with mcget to look if its "true" to send the request to specific webtop? or if he will write in the session dump the variable session.X.X."HEADER_NAME" it will be there for the next HTTP request as well..?

     

  • tikshoret's avatar
    tikshoret
    Icon for Nimbostratus rankNimbostratus
    Feb 18, 2015

    i don't think i want to send the webtop name in the url you know..

     

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Feb 18, 2015

    You know, I'm not sure you can assign multiple webtops, so you may just have to have the logic assign a webtop which will won't change throughout the entire session. Since the 

    HTTP_REQUEST
    executes prior to the session getting created, you may run into a problem with this. You might consider setting a variable in the 
    HTTP_REQUEST
    event and then using the 
    ACCESS_SESSION_STARTED
    event to set the session variable when the session gets initialized. From there, you could assign the right webtop based on that variable (I'd recommend using a single session variable and letting the value be something sepcific, or default to an empty string if no match). At that point, the webtop would be assigned and when the policy finishes (assuming you're not doing any redirection away from the webtop after login completes), they should see the desired webtop. Perhaps something like this:

    when HTTP_REQUEST { 
    if { [HTTP::header exists "HEADER_NAME"] } { 
        log local0 "HEADER_NAME EXISTS" 
        set headerName "HEADER_NAME"
    }
}
when ACCESS_SESSION_STARTED {
     Check that the variable exists
    if { [info exists headerName] } {
        switch $headerName {
            "HEADER_NAME_1" {
                ACCESS::session data set session.custom.WHATEVER "value_1"
            }
            "HEADER_NAME_2" {
                ACCESS::session data set session.custom.WHATEVER "value_2"
            }
        }
    }
}