err tmm1[24399]: 011f0007:3: http_process_state_prepend - Invalid action:0x107041 clientside

[akelekar]

I'm trying to setup a iRule that will terminate my F5 sessions and call the logout for our Microsoft ADB2C policy.

when ACCESS_ACL_ALLOWED { 

if { [HTTP::uri] contains "Logoff" } { 

    ACCESS::session remove 

    after 200

    HTTP::redirect "https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Fjwt.ms%2F"

log local0. "iRule logout triggered: Removing access session for [ACCESS::session sid]" 

} 

}

But when the user clicks on the Logoff, I see the following in the LMT log and the following error in the browser

Hmmm… can't reach this page 

err tmm[24399]: 011f0007:3: http_process_state_prepend - Invalid action:0x107041 clientside (X.X.x.x:61335 -> y.y.y.y:443) ((null connflow))

What are we not doing right here. This is from Microsoft documentation

Thanks

Atul

[Paulius]

@akelekar Which document are you using?

[akelekar]

https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect#send-a-sign-out-request

And

https://my.f5.com/manage/s/article/K42052145

[Paulius]

@akelekar You are positive you have met the APM prerequisites for this to function properly?

[akelekar]

Not sure I understand what prerequites are needed. I do have admin rights on the server. 

I was hoping to get some more info on what the LMT error means

err tmm[24399]: 011f0007:3: http_process_state_prepend - Invalid action:0x107041 clientside (X.X.x.x:61335 -> y.y.y.y:443) ((null connflow))

[Paulius · Accepted solution]

@akelekar It doesn't seem that the iRule is exactly the same as the referenced but before troubleshooting that log I would recommend that you have the APM pieces in place because it is possible that they might be related.

[akelekar]

Can you please elaborate on "have the APM pieces in place"?

As far as we see, the APM itself seems to be working fine. If the users session is new, it sends it to the ADB2C for signin and after signin, it forwards the request to the corrct app. THe per-request and persession policies seem to be working fine with the session variables being copied correctly and passed as header to the application.