For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

yves_werniers_1's avatar
yves_werniers_1
Icon for Nimbostratus rankNimbostratus
Jul 17, 2014

Send credentials to backend servers through APM

Hello,   I have a Virtual Server on F5 APM to be used as reverse proxy. It is protecting a website that uses many different applications and backend servers. Some of those applications are publicl...
BIG-IP Access Policy Manager (APM)
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jul 17, 2014

This is a little different than your specific question, but I think it might be useful. The idea in the iRule below is that you disable the access policy until the user accesses a protected URI (defined in a string-based data group). Once the access policy has been initiated, all subsequent requests go through the completed access policy regardless of requested URI. 

when HTTP_REQUEST {
    if { ( [HTTP::cookie exists MRHSession] ) or ( [class match [string tolower [HTTP::uri]] starts_with my_private_uris] ) } {
        return
    } else {
        ACCESS::disable
        return
    }
}

You would then just apply the SSO profile to the access policy.