Forum Discussion
using step up auth to client cert want to insert cert into header
So i have a VS where you have to log in. one url /withcert needs to be protected with the user providing a client cert.
This is working, i have a per request policy, that matches the url and then uses subroutine to force a renegotiation with a client cert.
Now how do I get the client cert info into my headers.
when i look at active sessions, my main session doesn't have is a sub session so
subsession.ssl.cert.whole
seems to have the whole cert in there. how do I pass that back or how do I add that to headers ?
and that part of the variable name is at the end - looking via the web interface its very long ...
any help thanks
- spalandeNacreous
Have you checked what all session variables are populated from the client cert on APM. You can use any of them to add in the header. to begin with -
when ACCESS_ACL_ALLOWED { set certsubject [ACCESS::session data get session.ssl.cert.subject] HTTP::header insert "certsubjectdn" $certsubject }
- AlexS_ybCirrocumulus
Yes, well. its step up auth. so its not done on the access policy. but on a pre request policy. and also has to be done as a subroutine, so my reading tells me that per request subroutines don't have access to the session variables as writeable. only readable.
quick check via the gui interface and it show that the cert info is in the per request sub session variables. how can I insert headers from a subroutine in a pre request policy .. i thinking the only way is to use a irule event ...
but this seems rather hard.
Note - i am note sure when access_acl_allowed is fired, but I have checked the session variables - no sign of the cert in the main session variables :(
- spalandeNacreous
Can you see if HTTP_REQUEST is able to catch and parse cert details? This iRule is just to log the details first.
when HTTP_REQUEST { if {[SSL::cert count] > 0}{ set certsubjectdn [X509::subject [SSL::cert 0]] set certissuerdn [X509::issuer [SSL::cert 0]] log local0.info "certsubjectdn: $certsubjectdn" log local0.info "certissuerdn: $certissuerdn" } else { return } }
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com