For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Support for POST preservation when APM Multidomain SSO is configured

Problem this snippet solves: F5 doesn't support the preservation of the initial POST request when the Virtual Server has an access profile configured for Multidomain SSO. After authentication, the u...
Published Oct 23, 2017
Version 1.0
BIG-IP Access Policy Manager (APM)
devops
iRules
multi domain
post preservation
security
SSO
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
Nov 14, 2018

Hi Yann,

 

I tried to apply your code for a customer but I faced some limitation.

 

This code only works for the first request starting session.

 

I had the following behavior :

 

  • user request sharepoint website (not authenticated yet) with GET --> redirect to login page
  • user request login page with GET and authenticate --> redirect to sharepoint website
  • user want to edit with Office Web App behind APM, first request is a POST --> redirect to login page
  • user request login page with GET (already authenticated) --> redirect to Office Web App
  • browser send a GET request --> file edition fails
  • user refresh content --> file edition fails

I tried this code but session.server.body is only set for first request starting the session.

 

did you ever get this issue? did you try to solve it?