Forum Discussion

Ingebrigt_Maurs's avatar
Ingebrigt_Maurs
Icon for Nimbostratus rankNimbostratus
Dec 01, 2014

sessions without session cookies

Hi !

I'm writing an access policy for a legacy SOAP webservice. Clients are stateless, they do not recognize session cookies and do not resend them on subsequent requests. Clients do send a basic auth header with every request.

A client will sends thousands of requests over a short period of time. I would like to (but am unable to) set up APM to:

  • not create a new session for each request
  • recognize previously authenticated users by the basic auth string they send with each request

I have tried to set Default Persistence Profile to universal and control the sessions with the persist uie api. But I am unable to prevent creation of a new session for each request.

Example iRule

I tried to simplify and found that even if I hardcode the persist string to "foo" a new session is always created:

when HTTP_RESPONSE {
  persist add uie "foo"
  log local0. "persist add foo"
}

when HTTP_REQUEST {
  persist uie "foo"
  log local0. "uie lookup: [persist lookup uie "foo"]"
}

Each request will create a new session and log:

persist add foo
uie lookup:
application delivery
BIG-IP Access Policy Manager (APM)
devops
iRules
security

1 Reply

  • Ingebrigt_Maurs's avatar
    Ingebrigt_Maurs
    Icon for Nimbostratus rankNimbostratus
    Dec 08, 2014

    I got advice from Per Bøe and was able to adapt the approach in default iRule 

    _sys_APM_activesync

    The trick was to

    1. create a user_key from the basicauth header
    2. On ACCESS_SESSION_STARTED, write the user_key to session.user.uuid: 
      ACCESS::session data set "session.user.uuid" $user_key
    3. On subsequent HTTP_REQUEST's, find matching sessions by 
      ACCESS::user getsid $user_key
      and reuse them