APM Sharepoint authentication

Hi Stanislas,

Thanks for sharing this iRule to Devcentral.

I'm even wondering why this iRule hasn't won the 2016 coding challenge. The ability to support MSOFBA is so much required for every SharePoint and esp. these WS-Federation based deployments. O well, but a (highly insecure) SCEP based certificate enrollment page for iPhones sounds so much cooler, isn't it? To bad that I have not found the time to vote for you... ;-)

BTW: Your last code update has broken the formating of the code. It contains now a lot of & and some malformated .

Cheers, Kai

Hi Kai,

Thank you for the comment.

I rollback to the previous version. I am not able to upload new content without & and HTML header...

the only difference with the new version is line 113. I forgot to insert quote before and after realm name.

the line must be:

ACCESS::respond 401 noserver WWW-Authenticate "Basic realm=\"$static::Basic_Realm_Text\"" Connection close

Thank you for sharing, it has got me a long way to a successful configuration.

I have built up a sharepoint installation using SSO with PKI to Kerberos. So the user presents there certificate because of client ssl profile. After client cert inspection and OCSP in access profile a SSO configuration does the Kerberos lookup to pass to SharePoint.

Now I have added OWA on a separate VIP which also checks client certificate.

The iRule takes care of switching to clientless mode when OWA connects to SharePoint VIP. I have modified it to also check for the OWA request is from a known list. I have modified the access policy to bypass client cert inspection based on above change to iRule. I also found I had to switch to clientless mode when user-agent = microsoft office protocol discovery.

I don't think I have any forms based authentication so I have removed that code from the iRule.

What I would be interested in is some commentary as to how the iRule works please. Are you able to share the access policy as well please? Thank you.

Hey Stanislas,

I'm currently in the process in writing an iRule for ADFS protected SharePoints. Recycled some parts of your iRule and optimized some parts here and there. Also found some interesting tweaks for native Windows WebDav Client. Will send you the outcome once finished... ;-)

Cheers, Kai

Hi Kai,

This irule is working on VS with following access profiles:

• SAML SP with SAML IdP with fallback to AD Auth for non MSOFBA clients (session.clientless variable condition to choose authentication method)
• Standard Logon Page / AD Auth
• Standard Logon Page / AD Auth with Captcha

If you write an irule to improve APM / sharepoint compatibility, please share it.

Hi Stanislas,

In a native ADFS-based SharePoint collaboration scenario you cannot use AD fallbacks. The SAML user accounts are most likely stored in many decentralized repositories, without a direct trust nor network access to them.

My goal was to get everything working without using the AD fallback at all. Well, I had to skip the support for outdated MS Office products and changed the handling of Microsoft WebDav Clients slightly. In addition I've restructured the code here and there to reduce the complexity and increase the performance...

when CLIENT_ACCEPTED {
    set inject_session_cookie 0
}
when HTTP_REQUEST {
     Check if APM session cookie is present and valid
    if { ( [set sessionid [HTTP::cookie value "MRHSession"]] ne "" ) and
         ( [ACCESS::session exists -state_allow $sessionid] ) } then {
         Allow the successfully pre authenticated request to pass
    } else {
         Check if persistent APM session cookie is present and valid
        if { ( [set sessionid [HTTP::cookie value "MRHSession_SP"]] ne "" ) and
         ( [ACCESS::session exists -state_allow $sessionid] ) } then {
             Restore APM session cookie value
            HTTP::cookie insert name "MRHSession" value $sessionid
            set inject_session_cookie 1 
             Allow the successfully pre authenticated request to pass
        } else {
             Enumerate explicit MS-OFBA authentication capabilities
             Background: https://msdn.microsoft.com/en-us/library/office/cc313069(v=office.12).aspx
            if { ( [HTTP::header "X-FORMS_BASED_AUTH_ACCEPTED"] equals "t" ) or 
                 ( [HTTP::header "X-FORMS_BASED_AUTH_ACCEPTED"] equals "f" ) } then {
                 Explicit MSOFBA support detected. 
                set authschema "ms-ofba"
            } else {
                 Enumerate implicit MS-OFBA authentication capabilities
                switch -glob -- [string tolower [HTTP::header "User-Agent"]] "*office protocol discovery*" - \
                  "*microsoft office*" - \
                  "*microsoft data access internet publishing provider*" - \
                  "*non-browser*" - \
                  "msoffice 12*" - \
                  "*microsoft-webdav-miniredir*" - \
                  {*ms frontpage 1[23456789]*} {
                     Implicit MSOFBA support detected.   
                    set authschema "ms-ofba"
                } "*ms frontpage*" {
                     Legacy client detected
                    set authschema "legacy"
                } "*mozilla*" - \
                  "*opera*" {
                     Regular web browser detected.  
                    set authschema "browser"
                } default { 
                    set authschema "legacy"
                }
            }
            if { $authschema eq "ms-ofba" } then {
                 Send a MSOFBA compatible Access Denied response 
                if { [HTTP::path] ne "/sp-msofba-form" } then {
                    HTTP::respond 403 -version "1.1" \
                                      content "Access Denied. Make sure that your client is correctly configured. See https://support.microsoft.com/en-us/kb/932118 for further information." \
                                      noserver \
                                      "Content-Type" "text/html" \
                                      "X-FORMS_BASED_AUTH_REQUIRED" "https://[getfield [HTTP::host] ":" 1]/sp-msofba-form" \
                                      "X-FORMS_BASED_AUTH_RETURN_URL" "https://[getfield [HTTP::host] ":" 1]/sp-msofba-completed" \
                                      "X-FORMS_BASED_AUTH_DIALOG_SIZE" "800x600" \
                                      "Set-Cookie" "MRHSession=deleted;path=/;secure" \
                                      "Set-Cookie" "LastMRH_Session=deleted;path=/;secure" \
                                      "Set-Cookie" "MRHSession=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure" \
                                      "Set-Cookie" "LastMRH_Session=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure"
                }
            } elseif { $authschema eq "legacy" } then {
                 Send a regular Access Denied response 
                HTTP::respond 403 content "Access denied. An unsupported client access has been detected."
            } else {
                 Let the regular web browser request pass to the APM policy
            }
        }
    }
}

when ACCESS_SESSION_STARTED {
    if { [HTTP::cookie value "SAML_Realm"] ne "" } then {
        ACCESS::session data set "session.irule.realmcookie" [HTTP::cookie value "SAML_Realm"]
    }
}
when ACCESS_POLICY_COMPLETED {
    if { [set realm_cookie [ACCESS::session data get "session.irule.setrealmcookie"]] ne "" } then {
        ACCESS::respond 302 "Location" "[ACCESS::session data get "session.server.landinguri"]" "Set-Cookie" "SAML_Realm=$realm_cookie;path=/;secure"
    } else {
        ACCESS::respond 302 "Location" "[ACCESS::session data get "session.server.landinguri"]" 
    }
}
when ACCESS_ACL_ALLOWED {
    switch -glob -- [string tolower [HTTP::path]] "/sp-msofba-form" {
         Successfully APM authenticated request MS-OFBA request detected. Redirect to MS-OFBA return URL
        ACCESS::respond 302 noserver Location "/sp-msofba-completed"
    } "/sp-msofba-completed" {
         Successfully APM authenticated request MS-OFBA request detected. Sending MS-OFBA return response
        ACCESS::respond 200 content "AuthenticatedGood Work, you are Authenticated" noserver
    } "*/signout.aspx" {
         SharePoint SignOut signature detected. Disconnect session and redirect to APM logout Page
        ACCESS::respond 302 noserver Location "/vdesk/hangup.php3"
    } "/_layouts/accessdenied.aspx" {
         SharePoint AccessDenied signature detected.
        if { [string tolower [URI::query [HTTP::uri] loginasanotheruser]] equals "true" } then {
             SharePoint LoginAsAnotherUser request detected. Killing the APM session an sending redirect to www-root.
            ACCESS::session remove
            ACCESS::respond 302 noserver Location "/"
            return
        }
    } default {
          Let the authenticated request pass
    }
}
when HTTP_RESPONSE {
    if { [HTTP::header "Content-Type" ] contains "text/html" } then {
         Insert persistent APM session cookie into HTTP response.
        HTTP::header insert "Set-Cookie" "MRHSession_SP=$sessionid;path=/;secure"
        HTTP::cookie expires "MRHSession_SP" 120 relative
    }
    if { $inject_session_cookie } then {
         Insert APM session cookie into HTTP response.
        HTTP::header insert "Set-Cookie" "MRHSession=$sessionid;path=/;secure"
        set inject_session_cookie 0
    }
}

Note: Your Clientless_Mode support can be easily included in the provided script. You just need to insert your existing code into the

elseif { $authschema eq "legacy" } then {

[ACCESS::user getsid $user_key]

Update: Changed the session cookie injection mechanism.

Cheers, Kai