APM Sharepoint authentication v2

Problem this snippet solves:

This new version of irule supports NTLM auth (mandatory for Onedrive Apps)

APM is a great authentication service but it does it only with forms.

The default behavior is to redirect user to /my.policy to process VPE. this redirect is only supported for GET method.

Sharepoint provide 3 different access types:

browsing web site with a browser

• Editing documents with Office
• connect to One Drive on premise from PC and mobiles
• browser folder with webdav client (or editing documents with libreoffice through webdav protocol)

This irule display best authentication method for each of these access types:

• browsers authenticate with default authentication method (form based authentication)
• Microsoft office authenticate with Form based authentication (with support of MS-OFBA protocol)
• Libreoffice and webdav clients authenticate with 401 basic authentication (NTLM and Basic)
• Form based authentication (browser and Microsoft office) is compatible (validated for one customer) with SAML authentication
• NTLM auth for Onedrive mobile applications

Editing documents is managed with a persistent cookie expiring after 5 minutes. to be shared between IE and Office, it requires :

• cookie is persistent (expiration date instead of deleted at the end of session)
• web site defined as "trusted sites" in IE.

How to use this snippet:

install this irule and enable it on the VS.

In the first HTTP_REQUEST event, configure authentication mode list by setting the AUTHENTICATION_MODE variable

Set authentication mode list supported. possible values are :

• form :default Form based authentication
• msofba : Microsoft Office Form Based Authentication for Office and Onedrive apps

• persist : Add persistent cookie to recover closed session. this function is only supported by form and msofba authentications.

  • --> persist word must be set after authentication mode : ex : {form persist} or {msofba persist}

• basic : Basic Authentication

• ntlm : NTLM Authentication

• negotiate : Kerberos / SPNEGO authentication : Not supported yet by this irule

  • --> basic, ntm and negotiate can be set together. ex: {negotiate ntlm basic} {ntlm basic}

• deny : send a 403 response code to deny the request

• disable : disable APM authentication

Code :

when RULE_INIT {
         #If NTLM Auth is defined below, define the ECA_METADATA_ARG with your NTLM profile and enable eca profile in virtual server configuration with tmsh command
         # modify ltm virtual [virtual name] profile add {eca}
         set static::ECA_METADATA_ARG "select_ntlm:/Common/NTLM-Auth"
         set static::session_restore_aes_key "AES 256 affeaffeaffeaffeaffeaffeaffeaffeaffeaffeaffeaffeaffeaffeaffeaffe"  ;# AES Key to protect and validate recovery data
         # Define required APM variables stored in the restore cookie to create new session with same security level.
         set static::session_restore_variables {
            session.ui.lang
            session.logon.last.username
            session.logon.last.logonname
            session.logon.last.krbdomain
            session.logon.last.domain
            session.krbsso.last.domain
            session.krbsso.last.username
            session.assigned.acls
            session.logon.last.domain
            session.sso.token.last.username
            session.user.sessiontype
         }
         # Cookie expire in 2 hours for the test...
         set static::session_restore_timeout 172800 ;### 7200 / 172800
      }
      
      when CLIENT_ACCEPTED {
         set last_ua_agent "init"
         # Set addtional HTTP headers in HTTP authentication responses
         set ADDITIONAL_AUTH_HEADERS "MicrosoftSharePointTeamServices 15.0.0.4763"
      }
      
      when HTTP_REQUEST {
         #################################### Authentication method selection #####################################################
         # Set authentication mode list supported. possible values are
         #   form :default Form based authentication
         #   msofba : Microsoft Office Form Based Authentication for Office and Onedrive apps
         #   persist : Add persistent cookie to recover closed session. this function is only supported by form and msofba authentications.
         #   --> persist word must be set after authentication mode : ex : {form persist} or {msofba persist}
         #   basic : Basic Authentication
         #   ntlm : NTLM Authentication
         #   negotiate : Kerberos / SPNEGO authentication : Not supported yet by this irule
         #   --> basic, ntm and negotiate can be set together. ex: {negotiate ntlm basic} {ntlm basic}
         #   deny : send a 403 response code to deny the request
         #   disable : disable APM authentication
         # Disable Authentication for Internal networks
         #if { [IP::addr [IP::client_addr]/25 equals 1.1.1.0] or [IP::addr [IP::client_addr]/25 equals 2.2.2.0] } {
         #     set AUTHENTICATION_MODE {disable}
         #     ASM::disable
         #     return
         #}
         #log local0. [HTTP::header "User-Agent"]
          if { $last_ua_agent equals [set last_ua_agent [HTTP::header value "User-Agent"]] } {
              # Do nothing, keep previous request authschema value
          } elseif {[HTTP::header exists "X-FORMS_BASED_AUTH_ACCEPTED"] && (([HTTP::header "X-FORMS_BASED_AUTH_ACCEPTED"] equals "t") || ([HTTP::header "X-FORMS_BASED_AUTH_ACCEPTED"] equals "f"))} {
              set AUTHENTICATION_MODE {msofba}
          } else {
              switch -glob -- [string tolower [HTTP::header "User-Agent"]] {
                  "*microsoft office *ios*" -
                  "*onedriveiosapp*" -
                  "onedrive/*darwin*" {
                     # NTLM is the only one supported for onedrive mobile
                     set AUTHENTICATION_MODE {ntlm basic}
                     #set AUTHENTICATION_MODE {deny}
                  }
                  "*microsoft office onedrive*" -
                  "*microsoft onedrive*" -
                  "*microsoft office skydrive*" -
                  "*microsoft office syncproc*" -
                  "*microsoft office upload center*" -
                  "*office protocol discovery*" -
                  "*microsoft office*" -
                  "*microsoft data access internet publishing provider*" -
                  "*non-browser*" -
                  "msoffice 12*" -
                  "*microsoft-webdav-miniredir*" -
                  "*ms frontpage 1[23456789]*" {
                      # Implicit MSOFBA support detected.   
                      set AUTHENTICATION_MODE {msofba}
                      #set AUTHENTICATION_MODE {ntlm basic}
                  }
                  "*ms frontpage*" {
                      # Legacy client detected
                      set AUTHENTICATION_MODE {ntlm basic}
                      #set AUTHENTICATION_MODE {deny}
                  }
                  "*mozilla*" -
                  "*opera*" {
                      # Regular web browser detected.  
                      set AUTHENTICATION_MODE {form}
                  }
                  default { 
                      set AUTHENTICATION_MODE {ntlm basic}
                      #set AUTHENTICATION_MODE {msofba}
                  }
              }
              #log local0. "[IP::remote_addr] : [string tolower [HTTP::header "User-Agent"]] : $AUTHENTICATION_MODE : [HTTP::cookie value MRHSession] : [HTTP::cookie value MRHSession_R]"
         }
         #################################### end of Authentication method selection ##############################################
      }
 
 
      priority 900
      
      when RULE_INIT {
        set static::AUTH_POLICY_FAILED                     "policy_failed"
        set static::AUTH_POLICY_SUCCEED                    "policy_succeed"
        set static::AUTH_POLICY_DONE_WAIT_SEC              5
 
        set static::AUTH_FIRST_BIG_POST_CONTENT_LEN        640000
        set static::AUTH_POLICY_RESULT_POLL_INTERVAL       100
        set static::AUTH_POLICY_RESULT_POLL_MAXRETRYCYCLE  100
        set static::AUTH_ACCESS_USERKEY_TBLNAME            "auth_access_userkey"
        set static::AUTH_ACCESS_LOG_PREFIX                 "01490000:7:"
 
        set static::AUTH_ACCESS_DEL_COOKIE_HDR_VAL         "MRHSession=deleted; \
                                                       expires=Thu, 01-Jan-1970 00:00:01 GMT;\
                                                       path=/"
 
    }
      
      when CLIENT_ACCEPTED {
         set clientless_mode 0
         set inject_session_cookie ""
         set inject_recover_cookie 0
         if { ! [ info exists ADDITIONAL_AUTH_HEADERS ] } {
            set ADDITIONAL_AUTH_HEADERS     ""
         }
      }
      
      when HTTP_REQUEST {
         set inject_session_cookie ""
         if { ! [ info exists f_ntlm_auth_succeed ] } {
            set f_ntlm_auth_succeed         0
         }
         if { ! [ info exists sid_cache ] } {
            set sid_cache                         ""
         }
        if { ! [ info exists PROFILE_POLICY_TIMEOUT ] } { 
            set PROFILE_POLICY_TIMEOUT            [PROFILE::access access_policy_timeout]
        }
        if { ! [ info exists PROFILE_MAX_SESS_TIMEOUT ] } {
            set PROFILE_MAX_SESS_TIMEOUT          [PROFILE::access max_session_timeout]
        }
         if { ! [ info exists src_ip ] } {
            set src_ip                            [IP::remote_addr]
         }
          if { ! [ info exists PROFILE_RESTRICT_SINGLE_IP ] } {
              set PROFILE_RESTRICT_SINGLE_IP        [PROFILE::access restrict_to_single_client_ip]
          }
                 
        set persisted_session_timeout       [PROFILE::access inactivity_timeout]         
        set http_method                     [HTTP::method]
        set http_uri                        [HTTP::uri]
        set http_content_len                [HTTP::header Content-Length]
        set MRHSession_cookie               [HTTP::cookie value MRHSession]
          if { ! [ info exists AUTHENTICATION_MODE ] } {
              set AUTHENTICATION_MODE {form}
          }
 
        
         switch -- [lindex $AUTHENTICATION_MODE 0] {
            "disable" {
         #################################### APM Disable #########################################################################
         # disable APM and leave irule if mode is set to disable
               ACCESS::disable
               return
            }
            "form" {
         #################################### Form based authentication ###########################################################
         # Leave irule if authentication mode is set to default form base authentication
               if {[lindex $AUTHENTICATION_MODE 1] equals "persist"} {
                  set inject_recover_cookie 1} else {set inject_recover_cookie 0}
               set apm_sessionid [HTTP::cookie value "MRHSession"]
               if {![HTTP::cookie exists MRHSession] || !($inject_recover_cookie && [HTTP::cookie exists MRHSession_R])} {return}
            }
            "deny" {
         #################################### Deny Request ########################################################################
         # Respond with 403 response code and "Access Denied" content if mode is set to deny
               HTTP::respond 403 -version "1.1" \
                  content {Access Denied.} \
                  noserver \
                  "Content-Type" "text/html" \
                  "Set-Cookie" "MRHSession=deleted;path=/;secure" \
                  "Set-Cookie" "LastMRH_Session=deleted;path=/;secure" \
                  "Set-Cookie" "MRHSession=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure" \
                  "Set-Cookie" "LastMRH_Session=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure"
               return
            }
            default {
         #################################### All other authentication methods #####################################################
         # provision response Headers for specific authentication
               set httpheaders "$ADDITIONAL_AUTH_HEADERS Set-Cookie \"MRHSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/\" Connection close"
               set httpcontent "ForbidenAuthentication\\ Required"
               set httpcode 401
               foreach authvalue $AUTHENTICATION_MODE {
                  switch $authvalue {
                     basic {
                        append httpheaders " WWW-Authenticate \"Basic realm=\\\"[HTTP::host]\\\"\""
                     }
                     ntlm {
                        append httpheaders " WWW-Authenticate NTLM"
                     }
                     negotiate {
                        # Authentication method negociate not managed by this irule yet
                        append httpheaders " WWW-Authenticate Negotiate"
                     }
                     msofba {
                           #log local0. [HTTP::cookie value MRHSession_SP]
                        if {[lindex $AUTHENTICATION_MODE 1] equals "persist" && [HTTP::cookie exists MRHSession_R]} {
                           set persisted_session_timeout 300
                        } elseif {[HTTP::path] ne "/vdesk/ms-ofba-form"} {
                           append httpheaders " \"Content-Type\"\ \"text/html\""
                           append httpheaders " X-FORMS_BASED_AUTH_REQUIRED"\ "https://[getfield [HTTP::host] ":" 1]/vdesk/ms-ofba-form?mode=[lindex $AUTHENTICATION_MODE 1]"
                           append httpheaders " X-FORMS_BASED_AUTH_RETURN_URL"\ "https://[getfield [HTTP::host] ":" 1]/vdesk/ms-ofba-completed"                           
                           append httpheaders " X-FORMS_BASED_AUTH_DIALOG_SIZE"\ "800x600"
                           set httpcontent "ForbidenAccess\\ Denied.\\ Make\\ sure\\ that\\ your\\ client\\ is\\ correctly\\ configured.\\ See\\ https://support.microsoft.com/en-us/kb/932118\\ for\\ further\\ information."
                           set httpcode 403
                        }
                     }
                  }
               }
            }
         }
 
         #################################### NTLM already authenticated connection ###############################################
         if {$f_ntlm_auth_succeed} {
            # enable ECA profile for already NTLM authenticated connections and ignore this irule event
            ECA::enable
            ECA::select $static::ECA_METADATA_ARG
            return
         }
         #################################### Valid session request : MHRSession Cookie ###########################################
         if { ( [set apm_sessionid [HTTP::cookie value "MRHSession"]] ne "" ) and ( [ACCESS::session exists -state_allow $apm_sessionid] ) } then {
             # Allow the successfully pre authenticated request to pass
             return
         #################################### Valid session request : MHRSession_R Cookie ########################################
         ### This cokie is inserted to allow a user to log with recorded data stored on a encrypted cookie
         } elseif {([lindex $AUTHENTICATION_MODE 0] ne "form") and ( [set apm_sessionid [HTTP::cookie value "MRHSession_SP"]] ne "" ) and ( [ACCESS::session exists -state_allow $apm_sessionid] ) } then {
         #################################### Valid session request : MHRSession_SP Cookie ########################################
            # Check if persistent APM session cookie is present and valid
            # Restore APM session cookie value
            HTTP::cookie insert name "MRHSession" value $apm_sessionid
            set inject_session_cookie $apm_sessionid 
            # Allow the successfully pre authenticated request to pass
            return
         } elseif { [lindex $AUTHENTICATION_MODE 1] equals "persist" && [HTTP::cookie exists MRHSession_R]
         and ( [set session_restore_data [AES::decrypt $static::session_restore_aes_key [b64decode [HTTP::cookie value MRHSession_R]]]]  ne "" )} {
    array set restore_data $session_restore_data
    if {$restore_data(timeout) > [clock seconds] } {
               set user_key "persist.[PROFILE::access name].$restore_data(session.logon.last.username)"
               if {[set apm_sessionid [table lookup -subtable  APMSessionRestore $user_key]] != "" &&  ( [ACCESS::session exists -state_allow $apm_sessionid] ) } {
                  #log local0. "session recover by table"
               } elseif { ([ llength [set cookie_list [ ACCESS::user getsid $user_key ] ] ] != 0) and [set apm_sessionid [ ACCESS::user getkey [ lindex $cookie_list 0 ] ] ] ne ""} {
                     #log local0. "session recover by cookie list"
              } else {
               #log local0. "new session"
               if { [HTTP::header value "Accept-Language"] eq "" } then {
    # A "Accept-language" header is not present. Injecting language code = none
    HTTP::header insert "Accept-Language" "none"
}
set apm_sessionid [ACCESS::session create -timeout $persisted_session_timeout]
ACCESS::session data set -sid $apm_sessionid "session.policy.result" "allow"
foreach session_variable [lsearch -all -inline -not -exact [array names restore_data] timeout] {
    ACCESS::session data set -sid $apm_sessionid $session_variable $restore_data($session_variable)
    #log local0.debug "Adding $session_variable = $restore_data($session_variable)"
}
ACCESS::session data set -sid $apm_sessionid ".session.assigned.uuid" "tmm.uuid.$user_key"
                ACCESS::session data set -sid $apm_sessionid "session.user.uuid" $user_key
       }
            HTTP::cookie insert name "MRHSession" value $apm_sessionid
    set inject_session_cookie $apm_sessionid
            table set -subtable "APMSessionRestore"  $user_key $apm_sessionid $persisted_session_timeout indef
            unset restore_data user_key
            return
         }
         }
         #################################### Request with valid Authorization Header ############################################
         ### convert authentication header to be managed by APM
          if { [ llength [set auth_data [split [HTTP::header Authorization] " "]] ] == 2 } {
               if {[lsearch -exact $AUTHENTICATION_MODE [set authvalue [string tolower [ lindex $auth_data 0]]]] ne -1} {
                  switch $authvalue {
                      "ntlm" {
                          ECA::enable
                          ECA::select $static::ECA_METADATA_ARG
                      }
                      "basic" {
                          set clientless(insert_mode) 1
                          set clientless(src_ip)      [IP::remote_addr]
                          set clientless(username)    [ string tolower [HTTP::username] ]
                          set clientless(password)    [HTTP::password]
                          if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {
                              binary scan [md5 "$clientless(password)"] H* clientless(hash)
                          } else {
                              binary scan [md5 "$clientless(password)$clientless(src_ip)"] H* clientless(hash)
                          }
                          set user_key "$clientless(username).$clientless(hash)"
                          set clientless(cookie_list)             [ ACCESS::user getsid $user_key ]
                          if { [ llength $clientless(cookie_list) ] != 0 } {
                             set clientless(cookie) [ ACCESS::user getkey [ lindex $clientless(cookie_list) 0 ] ]
                             if { $clientless(cookie) != "" } {
                                HTTP::cookie insert name MRHSession value $clientless(cookie)
                                set clientless(insert_mode) 0
                             }
                         }
                         if { $clientless(insert_mode) } {
                             HTTP::header insert "clientless-mode" 1
                             HTTP::header insert "username" $clientless(username)
                             HTTP::header insert "password" $clientless(password)
                             set clientless_mode 1
                         }
                         unset clientless
                      }
                      "negotiate" {
                        #log local0.  [getfield [HTTP::header Authorization] " " 2]
                        #set clientless(insert_mode) 1
                        #set clientless(authparam) [getfield [HTTP::header Authorization] " " 2]
                        #log local0. $clientless(authparam)
                        #log local0. [string length $clientless(authparam)]
                        #set clientless(decode) [b64decode $clientless(authparam)]
                        ##log local0. [sha256 "$clientless(decode)"]
                        #binary scan [sha256 "$clientless(decode)"] H* clientless(hash)
                        #log local0. $clientless(hash)
                        #set user_key "$clientless(hash)"
                        #set clientless(cookie_list)             [ ACCESS::user getsid $user_key ]
                        #  if { [ llength $clientless(cookie_list) ] != 0 } {
                        #     set clientless(cookie) [ ACCESS::user getkey [ lindex $clientless(cookie_list) 0 ] ]
                        #     if { $clientless(cookie) != "" } {
                        #        HTTP::cookie insert name MRHSession value $clientless(cookie)
                        #        set clientless(insert_mode) 0
                        #     }
                        # }
                        #if { $clientless(insert_mode) } {
                        #     HTTP::header insert "clientless-mode" 1
                        #     set clientless_mode 1
                        # }
                        # unset clientless
                      }
                      default {
                          #other authentication methodes are not managed by this irule yet
                      }
                  }
               }
         #################################### Redirect unmanaged requests with supported authentication method  ##################               
           } else {
                eval HTTP::respond $httpcode -version 1.1 content $httpcontent noserver $httpheaders
               return
           }
      }
      
      
      when HTTP_RESPONSE {
          # Insert persistent cookie for html content type and private session
          if { [HTTP::header "Content-Type" ] contains "text/html" && [info exists "apm_sessionid"]} {
              HTTP::cookie remove MRHSession_SP
              HTTP::cookie insert name MRHSession_SP value $apm_sessionid path "/"
              HTTP::cookie expires MRHSession_SP 300 relative
              HTTP::cookie secure MRHSession_SP enable
          }
          # Insert session cookie if session was recovered from persistent cookie
          if { ([info exists "inject_session_cookie"]) && ($inject_session_cookie ne "") } {
              HTTP::cookie insert name MRHSession value $inject_session_cookie path "/"
              HTTP::cookie secure MRHSession enable
              #log local0. "injected $inject_session_cookie"
          }
         if { $inject_recover_cookie } then {
                  # Insert APM recover session cookie into HTTP response.
                  set session_restore_data "[clock seconds] [ACCESS::session data get "session.logon.last.username"]"
                  foreach session_variable $static::session_restore_variables {
                      if { [set session_variable_value [ACCESS::session data get $session_variable]] ne "" } then {
                          lappend session_restore_data "$session_variable=$session_variable_value"
                      }
                  }
                  HTTP::header insert "Set-Cookie" "MRHSession_R=[b64encode [AES::encrypt $static::session_restore_aes_key $session_restore_data]];Path=/;Secure;HttpOnly"
                  set inject_recover_cookie 0
         }
        if {[HTTP::header exists "Transfer-Encoding"]} {
            HTTP::payload rechunk
        }
      }
      
      when ACCESS_SESSION_STARTED {
          if {[set landinguri [ACCESS::session data get session.server.landinguri]] equals "/vdesk/ms-ofba-form?mode=persist" } {
            ACCESS::session data set session.server.landinguri "/vdesk/AddPersistentCookie?url=[b64encode "/vdesk/ms-ofba-completed"]"
          } elseif {([info exists "inject_recover_cookie"])} {
              ACCESS::session data set session.server.landinguri "/vdesk/AddPersistentCookie?url=[b64encode [ACCESS::session data get session.server.landinguri]]"
              ACCESS::session data set session.inactivity_timeout 300
          }
          if {([info exists "clientless_mode"])} {
              ACCESS::session data set session.clientless $clientless_mode
              if {$clientless_mode} {
               ACCESS::session data set session.inactivity_timeout 300
               if {[HTTP::header Authorization] starts_with "Negotiate"}{
                  ACCESS::session data set session.logon.last.authtype "Negotiate"         
                  ACCESS::session data set session.logon.last.authparam [getfield [HTTP::header Authorization] " " 2]
               }
              }
          }
          if { [ info exists user_key ] } {
              ACCESS::session data set "session.user.uuid" $user_key
          }
      }
      
      when ACCESS_POLICY_COMPLETED {
         if { ! [ info exists user_key ] } {
            return
        }
        
        set user_key_value ""
        set f_delete_session 0
        set policy_result [ACCESS::policy result]
        set sid [ ACCESS::session sid ]
 
        switch $policy_result {
        "allow" {
            set user_key_value          $sid
            set sid_cache               $user_key_value
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Result: Allow: $user_key"
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX sid = $sid"
 
        }
        "deny" {
            eval ACCESS::respond 401 -version 1.1 content {ForbidenAuthentication\ Required} noserver $httpheaders
            set f_delete_session  1
        }
        default {
            ACCESS::respond 503 content  $static::actsync_503_http_body Connection Close
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Got unsupported policy result for $user_key ($sid)"
            set f_delete_session  1
        }
        }
 
        if { $f_ntlm_auth_succeed == 1 } {
            if { $user_key_value != "" } {
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Setting $user_key => $static::AUTH_POLICY_SUCCEED"
                table set -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME $user_key $static::AUTH_POLICY_SUCCEED
            } else {
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Setting $user_key => $static::AUTH_POLICY_FAILED  $static::AUTH_POLICY_DONE_WAIT_SEC $static::AUTH_POLICY_DONE_WAIT_SEC in table $static::AUTH_ACCESS_USERKEY_TBLNAME"
                table set -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME $user_key $static::AUTH_POLICY_FAILED  $static::AUTH_POLICY_DONE_WAIT_SEC $static::AUTH_POLICY_DONE_WAIT_SEC
            }
        }
 
        if { $f_delete_session == 1 } {
            ACCESS::session remove
            set f_delete_session 0
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Removing the session for $user_key."
        }
      }
      
      when ACCESS_ACL_ALLOWED {
          switch -glob -- [string tolower [HTTP::path]] {
               "/vdesk/addpersistentcookie" {
                  set cookie_expire_absolute [expr {[clock seconds] + $static::session_restore_timeout}]
                  set cookie_expire_date  [clock format $cookie_expire_absolute -format "%a, %d-%b-%Y %H:%M:%S GMT" -gmt true]
                  set session_restore_data "timeout $cookie_expire_absolute"
                  foreach session_variable $static::session_restore_variables {
                      if { [set session_variable_value [ACCESS::session data get $session_variable]] ne "" } then {
                          lappend session_restore_data $session_variable $session_variable_value
                      }
                  }
                  set cookie [format "MRHSession_R=%s; path=/; expires=%s;Secure; HttpOnly" [b64encode [AES::encrypt $static::session_restore_aes_key $session_restore_data]] $cookie_expire_date]
                  ACCESS::respond 302 noserver Location [b64decode [URI::query [HTTP::uri] url]] "Set-Cookie" $cookie
               }
              "/vdesk/ms-ofba-form" {
                     ACCESS::respond 302 noserver Location "/vdesk/ms-ofba-completed"
              }
              "/vdesk/ms-ofba-completed" {
                  ACCESS::respond 200 content {
                      
                      Authenticated
                      Good Work, you are Authenticated
                      
                  } noserver
              }
              "*/signout.aspx" {
                  # Disconnect session and redirect to APM logout Page
                  ACCESS::respond 302 noserver Location "/vdesk/hangup.php3" "Set-Cookie" "MRHSession_R=deleted;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure"
                  event disable
                  TCP::close
                  return
              }
              "/_layouts/accessdenied.aspx" {
                  # Disconnect session and redirect to APM Logon Page
                  if {[string tolower [URI::query [HTTP::uri] loginasanotheruser]] equals "true" } {
                      ACCESS::session remove
                      ACCESS::respond 302 noserver Location "/" "Set-Cookie" "MRHSession_R=deleted;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure"
                      event disable
                      TCP::close
                      return
                  }
              }
              default {
                  # No Actions
              }
          }
      }
 
    when ECA_REQUEST_ALLOWED {
        set f_ntlm_auth_succeed                 1
 
        if { $MRHSession_cookie == "" } {
            # Retrieve from SID cache
            set MRHSession_cookie   $sid_cache
            HTTP::cookie insert name MRHSession value $sid_cache
        }
 
        if { $MRHSession_cookie != "" } {
            # Destroy session ID cache. This client should not need session ID cache 
            if { ($sid_cache != "") && ($sid_cache != $MRHSession_cookie) } {
                set sid_cache   ""
            }
            if { [ ACCESS::session exists -state_allow $MRHSession_cookie ] } {
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX HTTP *VALID* MRHSession cookie: $MRHSession_cookie"
                # Default profile access setting is false
                if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {
                    log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Release the request"
                    return
                }
                elseif { [ IP::addr $src_ip equals [ ACCESS::session data get -sid $MRHSession_cookie "session.user.clientip" ] ] } {
                    log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX source IP matched. Release the request"
                    return
                }
                else {
                    log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX source IP does not matched"
                }
            } else {
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX HTTP *INVALID* MRHSession cookie: $MRHSession_cookie"
            }
        }
 
        set MRHSession  ""
        set sid_cache   ""
        HTTP::cookie remove MRHSession
 
        # Build user_key
        set    user_key                 {}
        append user_key                 [string tolower [ECA::username]] "@" [ string tolower [ECA::domainname] ]
        if { $PROFILE_RESTRICT_SINGLE_IP == 0 } {
            append user_key             ":" $src_ip
        }
        append user_key                 ":" [ECA::client_machine_name]
 
        set apm_cookie_list             [ ACCESS::user getsid $user_key ]
        if { [ llength $apm_cookie_list ] != 0 } {
            set MRHSession_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]
            if { $MRHSession_cookie != "" } {
                set sid_cache           $MRHSession_cookie
                HTTP::cookie insert name MRHSession value $MRHSession_cookie
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX APM Cookie found: $sid_cache"
                return
            }
        }
        unset apm_cookie_list
 
        set try                         1
        set start_policy_str            $src_ip
        append start_policy_str         [TCP::client_port]
 
        while { $try <=  $static::AUTH_POLICY_RESULT_POLL_MAXRETRYCYCLE } {
 
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX NO APM Cookie found"
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Trying #$try for $http_method $http_uri $http_content_len"
 
            if { $http_content_len > $static::AUTH_FIRST_BIG_POST_CONTENT_LEN } {
                # Wait at below
            } else {
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX EXEC: table set -notouch -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME -excl $user_key $start_policy_str $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT"
                set policy_status [table set -notouch -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME -excl $user_key $start_policy_str $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT]
                log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX DONE: table set -notouch -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME -excl $user_key $start_policy_str $PROFILE_POLICY_TIMEOUT $PROFILE_MAX_SESS_TIMEOUT"
                if { $policy_status == $start_policy_str } {
                    # ACCESS Policy has not started. Start one
                    HTTP::header insert "clientless-mode"    1
                    set clientless_mode 1
                    break
                } elseif { $policy_status == $static::AUTH_POLICY_SUCCEED } {
                    log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX table is out-of-sync retry"
                    table delete -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME $user_key
                    continue
                } elseif { $policy_status == $static::AUTH_POLICY_FAILED } {
                    ACCESS::disable
                    TCP::close
                    return
                }
                # Wait at below
            }
 
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Waiting  $static::AUTH_POLICY_RESULT_POLL_INTERVAL ms for $http_method $http_uri"
            # Touch the entry table
            table lookup -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME $user_key
            after  $static::AUTH_POLICY_RESULT_POLL_INTERVAL
 
            set apm_cookie_list             [ ACCESS::user getsid $user_key ]
            if { [ llength $apm_cookie_list ] != 0 } {
                set MRHSession_cookie [ ACCESS::user getkey [ lindex $apm_cookie_list 0 ] ]
                if { $MRHSession_cookie != "" } {
                    set sid_cache           $MRHSession_cookie
                    HTTP::cookie insert name MRHSession value $MRHSession_cookie
                    log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX APM Cookie found: $sid_cache"
                    return
                }
            }
 
            incr try
        }
 
        if { $try >  $static::AUTH_POLICY_RESULT_POLL_MAXRETRYCYCLE } {
            log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Policy did not finish in [ expr { $static::AUTH_POLICY_RESULT_POLL_MAXRETRYCYCLE * $static::AUTH_POLICY_RESULT_POLL_INTERVAL } ] ms. Close connection for $http_method $http_uri"
            table delete -subtable  $static::AUTH_ACCESS_USERKEY_TBLNAME $user_key
            ACCESS::disable
            TCP::close
            return
        }
 
        log -noname accesscontrol.local1.debug "$static::AUTH_ACCESS_LOG_PREFIX Releasing request $http_method $http_uri"
 
        unset try
        unset start_policy_str
    }
 
      when ECA_REQUEST_DENIED {
         log local0. "User [ECA::username]@[ECA::domainname], Client Machine [ECA::client_machine_name], Auth Status [ECA::status]"
         set f_ntlm_auth_succeed                 0
      }

Tested this on version: