APM Clientless certificate authentication

Problem this snippet solves:

This code allow to configure certificate authentication with APM clientless-mode support.

The APM behavior when configuring following condition is to disable clientless-mode :

• APM clientless-mode in irule
• On-Demand Cert Auth in VPE

This code enable clientless mode if required based.

PS : this code use a list instead of a simple variable to be included in APM Sharepoint authentication code without changes.

How to use this snippet:

Edit the first HTTP_REQUEST event and add condition for enabling certificate authentication.

Code :

when HTTP_REQUEST {
    set AUTHENTICATION_MODE {certificate}
    #set AUTHENTICATION_MODE {none}
}

priority 900

when CLIENTSSL_CLIENTCERT {
    if {[SSL::cert count] < 1}{
        reject 
    } else {
        HTTP::release
    }
}

when HTTP_REQUEST {
    if { ( [set apm_sessionid [HTTP::cookie value "MRHSession"]] ne "" ) and ( [ACCESS::session exists -state_allow $apm_sessionid] ) } then {
        # Allow the successfully pre authenticated request to pass
         return
    }
    # Check authentication mode selected in previous HTTP_REQUEST event
    if  {[lindex $AUTHENTICATION_MODE 0] equals "certificate"} {
        if { [SSL::cert count] <= 0 } {
        # if there is no client certificate hold the HTTP request till the SSL re-negotiation is done.
            HTTP::header insert "clientless-mode"    1
            HTTP::collect
            SSL::session invalidate
            SSL::authenticate always
            SSL::authenticate depth 9
            SSL::cert mode require
            SSL::renegotiate
            
        } elseif {[info exists sessionid]} {
            # the previous HTTP request in the same TCP connection is already authenticated and session cookie is missing, Insert MRHSession
            HTTP::cookie insert name MRHSession value $apm_sessionid
        } else {
            # SSL client is already authenticated, but Access session not evaluated. enable clientless mode
            HTTP::header insert "clientless-mode"    1
        }
    }
}
when ACCESS_SESSION_STARTED {
    # catch session ID for next requests in the same TCP connection
    set apm_sessionid [ACCESS::session sid]
    # extract CN from subject and set in session.logon.last.username variable
    if  {[lindex $AUTHENTICATION_MODE 0] equals "certificate"} {
        # Allow comma and = to be included in subject. remove space at the end or beginning of strings.
        set subject [ split [string map {"\\," "," " , " "|" ", " "|" " ," "|" "," "|" "\\=" "=" " = " "|" "= " "|" " =" "|" "=" "|"} [X509::subject [SSL::cert 0]]] "|"]; 
        array set subject_list $subject
        if {[info exists subject_list(CN)]} {
            ACCESS::session data set session.logon.last.cn $subject_list(CN)
            ACCESS::session data set session.logon.last.username $subject_list(CN)
            ACCESS::session data set session.logon.last.logonname $subject_list(CN)
        }
        ACCESS::session data set session.logon.last.upn [findstr [ACCESS::session data get session.ssl.cert.x509extension] "othername:UPN<" 14 ">"]

    }
}