Need to collect dynamic content and using in HTTP redirect

Ok... I think this is it.

when ACCESS_ACL_ALLOWED {
            set var_issuer [ACCESS::session data get session.ssl.cert.issuer]
            set var_subject [ACCESS::session data get session.ssl.cert.subject]
            set var_upn [ACCESS::session data get session.custom.cert.upn]
            set var_email [ACCESS::session data get session.custom.cert.email]

            HTTP::header insert "X-F5-Forwarded-For" [IP::client_addr]
            log local0. "X-F5-Forwarded-For [IP::client_addr]"

            HTTP::header insert "X-F5-Session-ID" [ACCESS::session sid]
            log local0. "X-F5-Session-ID [ACCESS::session sid]"

            HTTP::header insert "X-F5-Session-Start" [ACCESS::session data get session.custom.start.time]
            log local0. "X-F5-Session-Start [ACCESS::session data get session.custom.start.time]"

            if { [info exists var_issuer] && ($var_issuer ne "") } {
                    HTTP::header insert "X-F5-Cert-Issuer" [ACCESS::session data get session.ssl.cert.issuer]
                    log local0. "X-F5-Cert-Issuer [ACCESS::session data get session.ssl.cert.issuer]" }
                    else { return }

            if { [info exists var_subject] && ($var_subject ne "") } {
                    HTTP::header insert "X-F5-Cert-Subject" [ACCESS::session data get session.ssl.cert.subject]
                    log local0. "X-F5-Cert-Subject [ACCESS::session data get session.ssl.cert.subject]" }
                    else { return }

            if { [info exists var_upn] && ($var_upn ne "") } {
                    HTTP::header insert "X-F5-Cert-UPN" [ACCESS::session data get session.custom.cert.upn]
                    log local0. "X-F5-Cert-UPN [ACCESS::session data get session.custom.cert.upn]" }
                    else { return }

            if { [info exists var_email] && ($var_email ne "") } {
                    HTTP::header insert "X-F5-Cert-Email" [ACCESS::session data get session.custom.cert.email]
                    log local0. "X-F5-Cert-Email [ACCESS::session data get session.custom.cert.email]" }
                    else { return }
}

Hi Eric,

lets make a real life comparsion of what your iRule does.

You have an entrance hall with a service desk where lots of customers are flowing in and you have a back office where your customer data is stored. Each time a customer visits your service desk your service desk operator is forced to walk several times into the backoffice to get the customer ID, their citizenship, their address and their prefered communication method independently.

Does this makes sense? I guess it would be far more effective to store your customer data in such way, that a single walk into the back office would be sufficent to process a customer, isn't it?

Your APM session variables and the

ACCESS_ACL_ALLOWED

Because of this it would be much smarter to substitute a

[list]

APM Variable Assign for Certificate-Users:

Variable Name:

session.custom.sso_header_injection

Expression:

return [list 1 [mcget {session.user.sessionid}] [mcget {session.custom.start.time}] [mcget {session.ssl.cert.issuer}] [mcget {session.ssl.cert.subject}] [mcget {session.custom.cert.email}]]

APM Variable Assign for non Certificate-Users:

Variable Name:

session.custom.sso_header_injection

Expression:

return [list 2 [mcget {session.user.sessionid}] [mcget {session.custom.start.time}]]

Highly optimized iRule:

when ACCESS_ACL_ALLOWED {

    log local0. "Injecting Header X-F5-Forwarded-For = [IP::client_addr]"

    HTTP::header insert "X-F5-Forwarded-For" [IP::client_addr]

    set sso_header_injection_list [ACCESS::session data get session.custom.sso_header_injection]

    log local0. "Retrieved header injection list = $sso_header_injection_list"

    if { [lindex $sso_header_injection_list 0] == 1 } then {

        log local0. "Certificate user detected..."

        log local0. "Injecting Header X-F5-SessionID = [lindex $sso_header_injection_list 1]"
        HTTP::header insert "X-F5-SessionID"      [lindex $sso_header_injection_list 1]

        log local0. "Injecting Header X-F5-Session-start = [lindex $sso_header_injection_list 2]"
        HTTP::header insert "X-F5-Session-start"  [lindex $sso_header_injection_list 2]

        log local0. "Injecting Header X-F5-Cert-Issuer = [lindex $sso_header_injection_list 3]"
        HTTP::header insert "X-F5-Cert-Issuer"    [lindex $sso_header_injection_list 3]

        log local0. "Injecting Header X-F5-Cert-Subject = [lindex $sso_header_injection_list 4]"
        HTTP::header insert "X-F5-Cert-Subject"   [lindex $sso_header_injection_list 4]

        log local0. "Injecting Header X-F5-Cert-Subject = [lindex $sso_header_injection_list 5]"
        HTTP::header insert "X-F5-Cert-Subject"   [lindex $sso_header_injection_list 5]

    } elseif { [lindex $sso_header_injection_list 0] == 2 } then {

        log local0. "Non-Certificate user detected..."

        log local0. "Injecting Header X-F5-SessionID = [lindex $sso_header_injection_list 1]"
        HTTP::header insert "X-F5-SessionID"      [lindex $sso_header_injection_list 1]

        log local0. "Injecting Header X-F5-Session-start = [lindex $sso_header_injection_list 2]"
        HTTP::header insert "X-F5-Session-start"  [lindex $sso_header_injection_list 2]

    }

}

Note: The iRule above requires only a single

[ACCESS::session]

Cheers, Kai