For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

RobC's avatar
RobC
Icon for Nimbostratus rankNimbostratus
Apr 25, 2016

Web link that would include a page variable

To move a legacy application to an F5 APM I need to include a logon page variable with invitations to the logon site. The legacy solution uses a custom URL for individual users who are invited. Something like visit.mypage.com/my.policy?user="14542" would need to be used to mimic that solution on the F5. Adding the variable in the few ways I know doesn't seem to work, I'm not sure if this is even possible.

 

application delivery
BIG-IP Access Policy Manager (APM)

4 Replies

  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Apr 25, 2016

    Hello,

    I'm not sure to understand exactly your needs but you may have use of irule similar to this one : 

    when HTTP_REQUEST {
    set user [URI::query [HTTP::uri] user]
    set enabled 0
    if { [HTTP::path] equals "/my.policy" and $user != "" } {
        set enabled 1
    }
}
when HTTP_RESPONSE {
    if { $enabled eq 1 and [HTTP::cookie exists MRHSession] } {
        ACCESS::session data set -sid [HTTP::cookie MRHSession] session.logon.last.username $user
    }
}

    And define a logon page only with a password input within the VPE.

  • Theo_12742's avatar
    Theo_12742
    Icon for Cirrus rankCirrus
    Apr 26, 2016
    To clarify, you want to check in your Access Policy whether certain elements from the URL exist (e.g. the Query String has a user attribute?
  • RobC's avatar
    RobC
    Icon for Nimbostratus rankNimbostratus
    Apr 26, 2016
    Yes, but if the URL contains a username I need to populate the username field. The URL; view.mysite.com/my.policy?input_1=user1 would populate the input_1 web site field and also allow the user to enter a username manually. Yann's idea may be a step in the right direction if I use 2 logon pages, one using his solution and another that has the username field visible and allows a user to enter a name manually.
  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Historic F5 Account
    Apr 27, 2016

    APM has a concept called "Landing URI".

     

    This is a session variable that is set when a user first visits the APM and gets a session cookie. This variable can be used during Access Policy evaluation, just like any other session variable.

     

    For example, if you hit APM with:

     

     

    the session's session.server.landinguri variable would be set to "/foo". Then you'd use that to complete the policy however you wanted.