04-Apr-2023 16:27
Had a requirement for a site that was moving from Apache with ACL's over to F5 in front of an Apache instance, that only requires a user certificate authentication for a specific /uri. For the SSL profile, I have to leave it at ignore, as request would always request a cert even for the other uri's.
In an irule I have an if statement in the HTTP_REQUEST block that says if the uri startswith /blah ACCESS::enable, else ACCESS::disable.
This works as desired for a browser client, but when using:
curl -k --cert ./mlanghorst_cert.pem --key ./mlanghorst_key.pem --cacert CA5_bundle.pem https://mydomain/protected_path/index.html
It doesn't seem to present the cert to the F5, since the SSL profile is ignore, it doesn't seem to renegotiate for the client cert.
Ideas on how to fix this?
05-Apr-2023 02:44
Try to enable clientless-mode for APM. Without this APM responses with a redirect to establish a session.
05-Apr-2023 07:45
Should've mentioned that. I've tried setting that header via curl -H 'Clientless-Mode: 1'. and within the irule:
#Set clientless mode for API
HTTP::header insert "clientless-mode" 1
Setting verbose, I see I'm getting a 302 redirect. If I add the -L switch, I get returned the my.policy page telling me I've been denied access.
10-Apr-2023 03:11 - edited 10-Apr-2023 03:19
Also you may try API protection profile as I think you are getting redirection based on APM login page or something like that. You can't use client cert but oauth access token is something similar as this is only what you have:
https://clouddocs.f5.com/training/community/access-solutions/solution13/guide/guide.html
https://www.youtube.com/watch?v=-2ndGH9Dp1Q
The oauth server can still accept the client ssl cert before giving the token:
-----------------
When configuring On-Demand certification authentication in a
, avoid having any other agent before the On-Demand Cert Auth agent if the client SSL profile on the virtual server has the
field set to