For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ray_371608's avatar
Ray_371608
Icon for Nimbostratus rankNimbostratus
Feb 05, 2019

Trying to do authentication with LDAP from iRule, not working

I'm trying to do some fairly simple authentication (basic auth to an ldap) for inbound traffic in an iRule and I'm having problems. At this point I'm pretty sure it's something I'm not doing right or...
iRules
LTM
security
Ray_371608's avatar
Ray_371608
Icon for Nimbostratus rankNimbostratus
Feb 05, 2019
The matching debug level log output for 1 transaction:

(time, level, host, service, status removed because they were all the same)

:  BEGIN ========= 2019-02-03_21:11:22 -0600 =========== 
:  BEGIN ========= HTTP_REQUEST
:  === Auth Step 1
:  === Auth Step 2
:  tmm_auth_sid : 1074998259
:  === Auth Step 3
:  Auth using -- and --
:  === Auth Step 6
:  === Auth Step 7
:  === Auth Step 8
:  === Auth Step 9
:  === Auth Step 10
:  === Auth Step 11
:  END ========= HTTP_REQUEST
:  BEGIN ========= AUTH_RESULT
:  === Auth Step 13
:  === Auth Step 14
:  AuthStatus is: -1-
:  === Auth Step 16
:  === Auth Step 22
:  === Auth Step 23
:  === Auth Step 25
:  === Auth Step 26
:  END ========= AUTH_RESULT
:  BEGIN ========= HTTP_REQUEST
:  === Auth Step 1
:  === Auth Step 5
:  tmm_auth_sid : 1074998259
:  Auth using -prw- and -xxxxxxx-
:  === Auth Step 6
:  === Auth Step 7
:  === Auth Step 8
:  === Auth Step 9
:  === Auth Step 10
:  === Auth Step 11
:  END ========= HTTP_REQUEST
:  BEGIN ========= AUTH_RESULT
:  === Auth Step 13
:  === Auth Step 14
:  AuthStatus is: -1-
:  === Auth Step 16
:  === Auth Step 22
:  === Auth Step 23
:  === Auth Step 25
:  === Auth Step 26
:  END ========= AUTH_RESULT

I just don’t think it’s ever actually making the call to the LDAP. It looks like it gets to that step the first time without a UID/PWD, and doesn't try. Then when it has the UID/PWD in the second pass, nothing happens again. But I can run an ldapsearch from the command line of the F5 and get a valid response.