using step up auth to client cert want to insert cert into header

Can you see if HTTP_REQUEST is able to catch and parse cert details? This iRule is just to log the details first.

when HTTP_REQUEST {
  if {[SSL::cert count] > 0}{
   set certsubjectdn [X509::subject [SSL::cert 0]]
   set certissuerdn  [X509::issuer [SSL::cert 0]]
   log local0.info "certsubjectdn: $certsubjectdn"
   log local0.info "certissuerdn: $certissuerdn"
  } else {
    return
 }
}

yes I have tried and it didn't work

my presumption is [SSL::cert] looks at the current session data and the cert is not stored there. because it was initiated from a sub session

okay. Then only option I think of is configuring standard access policy where you can enable it in iRule only for uri /withcert or in VPE itself to check the uri. This should generate session variables from the cert you are looking for to send across the backend server

when HTTP_REQUEST { 
 if { [string tolower [HTTP::uri]] starts_with /withcert] } {
       ACCESS::enable
	} else {
	   ACCESS::disable
      }
    }
when ACCESS_ACL_ALLOWED {
    set certsubject [ACCESS::session data get session.ssl.cert.subject]
	HTTP::header insert "certsubjectdn" $certsubject
	}

Or log a support case on why per request policy is not working for session variables.

Hmm, not exactly what i want.

as for the support case - pretty sure the manual F5 stat subsession (pre request subroutines - need for stepup) can't access sessions variables and have their own subsession variables. they might be read only. definitely not allowed to write.

So the step places all the cert info into the subsession variables. which I want to grab and place in the session variables..

trying to do it with irule event, but can't get it to fire :(

Any technical reason you don't want per session access policy with rule based on landing uri or iRule? just FYI - there is a way to achieve this with standalone ltm based iRule as well and no need of per session or per request access policy (i.e. apm module)

Hi

No, i am a newbie and this is the current solution i have come up with if you can show me a better way - potentially easier happy to listen

So I will try and outline the problem i am trying to solve

I want users to be able to go to

https://www.example.com - with no APM no login .. as anon. let them use it

but when they hit

https://www.example.com/secret

I want APM to kick in - they must have a valid sso session - maybe group based (I have this working )

but when they hit

https://www.example.com/secret/ultraSecret

I want a OTP or some other MFA to kick in.

I have tried to stay away from using irule for all of that and used the VPE.

I have a sso multidomain setup its at auth.example.com

so that people can go to

https://www.example.com/

then to

https://clients.example.com/

with out having to re login again and to any other site I might manage under example.com

So my presumption is

Access policy - per session only kicks in at the first place a session is started. So

if user goes to

https://www.example.com/secret

APM bumps it to

https://auth.example.com/

and this is where Access policy per session starts - it uses the VPE for auth.example.com not www.example.com

and its only evaluated at session creation.

So thats why i created a per request access policy - also part of the zero trust setup.

So I can use this for

https://www.example.com/secret

bump up to needing to be authorized

and I can do the dump up for

https://www.example.com/secret/ultraSecret

I can force needing a cert - works well.

The issues is getting information from the subsession and back into the session variables.

I'm thinking maybe .. doing more googling that the localdb might be the place to also keep variables / info ...

if you have a different way to produce the above I would be happy to try it

thanks

In this sceneria, you can still have per session access policy configured for www.example.com VIP. landing uri can be used to seperate VPE flow. domain cookie (example.com) can be used for SSO across multiple sites withing the same domain. per session policy should populate the certificate variables you need.

Will keep the forum open for anyone else have idea to share for per request access policy.

Hi

Not so sure about that. but happy to proven wrong.

of if follow the flow i had above the person enters on a different uri that doesn't need cert or step up

the AP landing uri is the one set at the creating of the AP, not on subsequence request ?

also the AP associated with this is not for www.example.com but on auth.example.com.

so I would need to build a branch for every vs i had - that would be comber some