Forum Discussion

Jared_46987's avatar
Jared_46987
Icon for Altostratus rankAltostratus
Aug 03, 2012

SharePoint Issues with F5 LTM and APM.

Hi everyone,

 

 

Is there a way for the APM to pass-through credentials to a server for users that are already logged in to their domain computers with domain credentials?

 

 

We have a new SharePoint 2010 site that is being used internally and externally. Right now everyone needs to authenticate through the F5 before accessing the site. However, I want people who are already logged in to the domain to not have to go through the extra login step each time. If the users browse via netbios name, the credentials are passed through and no login is needed - however, I would rather not have users browsing to sites in that fashion.

 

 

My second issue is my calendar items are not working properly when pumped through the F5. For instance, when users try to interact with the calendar (clicking to the next month, etc) it just says "Loading..." indefinitely. I have gone through the deployment guide and added a snippet of code as an iRule that was identified as correcting a similar issue with the top-bar Ribbon, but it doesn't seem to have any effect on this particular problem. Any ideas?

 

 

Thanks in advance!

 

 

 

microsoft
partner
  • Jared_46987's avatar
    Jared_46987
    Icon for Altostratus rankAltostratus
    Sep 11, 2012
    Posted By dubdub on 09/11/2012 06:00 AM

     

    Hi Jared,

     

     

    How were you able to get the source IP check working? I need to bypass an APM policy based on source IP and it's proving more difficult than I expected.

     

     

    Thanks,

     

    Jen

    Hey Jen -

     

    Here is the solution that worked for me:

     

    I added the "Check Source IP" variable to the beginning of my SharePoint access policy. Within that variable, go to Branch Rules, then Advanced, and enter this expression:

     

    expr { [mcget {session.userlocation}] == "internal" }

     

    Ok - now I have my completed Access Policy (see the attached picture for the full VPE). Now, go to Local Traffic -> iRules -> Data Group List and create a new list. I called mine "dg-internal-networks". Then select "Address" as the field type. Now you can add address records (i.e. a single IP address, or an entire network) to the list. I then created an iRule called "ir-apm-set-internal-netflag" and populated it with the following code:

     

    when ACCESS_SESSION_STARTED {

     

    if { [class match [ACCESS::session data get "session.user.clientip"] equals "dg-internal-networks" ] } {

     

    ACCESS::session data set "session.userlocation" "internal"

     

    } else {

     

    ACCESS::session data set "session.userlocation" "external"

     

    }

     

    }

     

    Now we're going to save the iRule and then apply this iRule to the virtual server in question. Once the iRule is applied, and assuming your Access policy is set correctly, you should be good to go. In the case of SharePoint, I had to add my sites public address to the "Intranet Trusted Sites" section within Internet Explorer before it would work correclty. This is also assuming your using NTLM on the backend and not kerberos.

     

    If you need some more help, just let me know!!

     

     

    Jared

     

     

  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    Aug 06, 2012
    Jared,

     

     

    Regarding issue 2 - I suggest you open a case with F5 support to troubleshoot it further. It is likely that either Sharepoint or F5 is misconfigured(maybe something with Alternate Access Mapping on Sharepoint?)

     

     

    Regarding authentication issue - can you please elaborate on your exact use case a bit more so that we can give you proper guidance? Do you have users internally that are not accessing Sharepoint from non-domain-joined machines? Just trying to properly understand your desire to have APM in front of Sharepoint internally and all the exact end-user behaviors you desire. Please clarify your exact desired scenarios a bit - thanks.
  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    Aug 06, 2012
    Jared,

     

     

    Thanks. I do have an idea on how you can potentially address this issue. You can leverage APM's end-point inspection capabilities for that. So, you would modify the policy to first check for user's source IP-address(I assume that the same VS is used for both external and internal users, else you can skip this step). Then you would invoke our end-point inspection to detect whether the user's machine is a domain-joined machine(a registry check or Windows info check and get Windows machine name and/or logged-on user for that machine, and if you are able to detect that, just let them through to the resource(end the policy in Allow ending) - that way client machine should authenticate to Sharepoint via NTLM silently, as you'd expect. For all other users, you'd want then to follow essentially the branch that you have depicted in your post.
  • Jared_46987's avatar
    Jared_46987
    Icon for Altostratus rankAltostratus
    Aug 22, 2012
    Just an update for anyone else in case this issue occurs for others: the calendar issue ended up being a problem with compression applied to SharePoint content from the F5. Once we turned off compression and the OneConnect policy, the calendar and some other ribbon functionality started working again.

     

     

    I was also able to get source IP checking working, and have a proof of concept model setup and rocking out, but not deployed company wide just yet.

     

     

    Thanks for the help!!
  • dubdub's avatar
    dubdub
    Icon for Nimbostratus rankNimbostratus
    Sep 11, 2012
    Hi Jared,

     

     

    How were you able to get the source IP check working? I need to bypass an APM policy based on source IP and it's proving more difficult than I expected.

     

     

    Thanks,

     

    Jen
  • dubdub's avatar
    dubdub
    Icon for Nimbostratus rankNimbostratus
    Sep 11, 2012
    Hi Jared,

     

     

    Thanks for the quick reply! I don't see your attachment, or Check Source IP as an option in APM's checks :( I understand how you set it up after that initial branch rule - I'm just not seeing where I can get that starting point.

     

     

    I am running 11.1 HF4.

     

     

    Thanks,

     

    Jen
  • Jared_46987's avatar
    Jared_46987
    Icon for Altostratus rankAltostratus
    Sep 11, 2012

    Jen - sorry I forgot a big part of this....when your adding the action inside your Access Policy, its actually called "Client-Side Check Capability". I then gave it the name "Check Source IP". Once you initially create that, go to Branch Rule and then change the existing rule. Copy in the code from above and you should be set (I also renamed it from Full to Internal).

     

    I'm getting an editor error when trying to embed an image, so you can just grab it from my Dropbox:

     

    http://dl.dropbox.com/u/61610234/Src_IP_VPE.JPG