Security issue - Oracle Identity System Administration login screen is exposed to public

Hi iaine,

I think the irule does not work due syntax error.

My portal (URL) is https://blabla.com//sysadmin/faces/signin

So i wrote the following.Please advise if the bold type (URI) fields are correct.

when CLIENT_ACCEPTED {

if {not [IP::addr [IP::client_addr] equals 10.0.40.0/24]} {

               log local0. "[IP::client_addr] does not match 10.0.40.0/24 AND access URI = /sysadmin/faces/signin"

set static::drop_notallowed 1

}

}

when HTTP_REQUEST {

if { [string tolower [HTTP::uri]] starts_with "https://blabla.com/sysadmin/faces/signin" }{

if {$static::drop_notallowed==1}{

drop

}

}

}