APM session username/password vars not copied in from iRule? Not showing in session report, and auth always fails
I am setting up a clientless mode policy for a web service, where the caller passes in a basic auth header, and I want to pass the provided username/password into the policy. The iRule I'm using to do this is as follows: when HTTP_REQUEST { HTTP::header insert "clientless-mode" 1 if { not ( [HTTP::header exists Authorization] ) } { HTTP::respond 401 WWW-Authenticate "Basic realm=\"FISERV Credentials\"" return } if { [HTTP::username] eq "" or [HTTP::password] eq "" } { HTTP::respond 401 WWW-Authenticate "Basic realm=\"FISERV Credentials\"" return } log local0. "In HTTP_REQUEST, FISERV Username [HTTP::username], pw [HTTP::password]" } when ACCESS_SESSION_STARTED { log local0. "In APM session, FISERV Username [HTTP::username], pw [HTTP::password]" ACCESS::session data set session.logon.last.username [HTTP::username] ACCESS::session data set session.logon.last.password [HTTP::password] } (Sorry, can't figure out how to do a clean code block). The LTM log shows the correct HTTP vars, in both events in the iRule. In the policy, i have a logging agent that dumps session.logon.*, but last.username and last.password are never present (the only session.logon vars shown are captcha.tracking, page.errorcode, and page.challenge, all blank). And my local user db auth agent always denies access, going down the "locked out" branch (even though the user is not locked out per the local user DB info elsewhere in the APM menues). I get the following errors associated with the auth attempt: "unable to decrypt user password due to invalid ciphertext" "Login for user FISERV, instance /Common/ESB-Fiserv rejected - Account locked out." Again, the account doesn't show as locked out, and attempts is 0. This is on 11.5.1HF5. Thoughts? Suggestions on how to debug? Should I put in a var assignment agent in the policy, and if so, how to I acccess the HTTP vars in that context? thx!
Problem with HTTP::respond, get rid of WWW-Authenticate header
Hi! Im trying to do this generic error page to display for 4XX and 5XX responses with the help from an iRule. This is what I did. when HTTP_RESPONSE { set DEBUG 0 if { $DEBUG } { log local0.debug "client_addr:[IP::client_addr] | cn:$cn | uid:$uid | serial:$serial | market:$market | uuid:$uuid | status:[HTTP::status] | method:$method | uri:$uri" } HTTP::header insert "Strict-Transport-Security" "max-age=16070400; includeSubDomains" switch -glob [HTTP::status] { "4*" { if { $DEBUG } { log local0.debug "masking 4XX error" } HTTP::respond [HTTP::status] content "<!doctype html><html><head><title>[HTTP::status]</title></head><body><div style=\"margin-left: 20px ; font-family: Arial,Helvetica,Verdana; font-size:100px; color: f0f0f0;\">[HTTP::status]</div></body></html>" } "5*" { if { $DEBUG } { log local0.debug "masking 5XX error" } HTTP::respond [HTTP::status] content "<!doctype html><html><head><title>[HTTP::status]</title></head><body><div style=\"margin-left: 20px ; font-family: Arial,Helvetica,Verdana; font-size:100px; color: f0f0f0;\">[HTTP::status]</div></body></html>" } default { if { $DEBUG } { log local0.debug "OK status returned" } Do nothing but returning the response } } } But now i have this problem, that everytime that a 401 is returned i.e "HTTP::respond 401", the header WWW-authenticate is returned which results in the stupid basic authentication login box is being displayed in the users browser. Not such a great scenario... since there is nothing to authenticate against. Does anyone know how to get rid of this? I have tried to remove the header with "HTTP::header remove WWW-Authenticate", doesn't work...Using SSL offload and passing traffic through to internal webserver
hi out there I have defined a vs - solely LTM (bigip 11.3) where I make use of SSL offload in the F5 and passing the http traffic through to a internal webserver. The intention was that we in phase one of this project get the frame for it up and run - the F5 should only take care of SSL offload and passing the traffic on to the internal server. But - The authentication fails - I have enabled basic authentication on the webserver (IIS7.5) and it replies nicely with a 401 which the first time is passed through to client on the outside of the F5. Afterwards it fails and I cannot really find out why. I have been using the standard http profiles etc - as much as possibly right out of the box. Eg.: my problem here is that the first time the client access the internal webserver the authentication runs correctly - but afterwards it is as if the authentication fails - the webserver writes 401 in the logfile.. Since it is SSL encrypted on the client side it is a bit hard to investigate in even thoguh I can see what we think we sends by dumping it out with tcpdump and decrypt with ssldump - but I am still not sure what is going wrong. Are there some common pitfalls here when we do a protocol-transition? best regards /tiRegarding http vip
Dear All, We are seeing an issue where when directly hitting the server the application working fine but when going via vip the request fails. I checked on tcpdump and found that for httpget request via vip we were seeing 401 in response header. The vip is standard vip, http type. So it can be possible that f5 does http inspection and when getting response 401 it is dropping connection. While when directly hitting the application server since source is browser the it may be ignoring the 401 code. Please suggest. Thanks for your help in advance. ThanksBASIC Auth on APM for web server
I am trying to put authentication in from of a IIS web server that is not running any kind of authentication. I can get it to work successfully by using a logon page ie - However as this is going to be called by a web service a logon page is not an option. Instead I am looking to present a 401 response using BASIC authentication. See below - The problem I am having is that while it is authenticated and there is a session created the F5 is then trying to present the credentials entered in the 401 challenge to the web server in the default pool. I don't want to present the credentials to the web server as the whole problem I am trying to solve is the fact that the web server is not running any authentication.APM, use HTTP basic auth semantics to retrieve e.g. RSA credentials?
Hi all - new-ish to APM - I think this is possible, but wanted to check. Rather than using a form to gather credentials from a user, is it possible to use the HTTP basic auth authentication scheme to gather the credentials, but configure the access policy so that the retrieved credentials are sent to an RSA server (accessed as a RADIUS AAA)? We already have a portal link working, with a form for user credential gathering - but we have some scenarios where it would be better if the client received an HTTP 401 status back, and gathered credentials via the built-in basic auth dialog. This is on 11.5.1 LTM (APM 11.5.1). Thx for any help!
Using SSL offload and passing traffic through to internal webserver
hi out there I have defined a vs - solely LTM (bigip 11.3) where I make use of SSL offload in the F5 and passing the http traffic through to a internal webserver. The intention was that we in phase one of this project get the frame for it up and run - the F5 should only take care of SSL offload and passing the traffic on to the internal server. But - The authentication fails - I have enabled basic authentication on the webserver (IIS7.5) and it replies nicely with a 401 which the first time is passed through to client on the outside of the F5. Afterwards it fails and I cannot really find out why. I have been using the standard http profiles etc - as much as possibly right out of the box. Eg.: my problem here is that the first time the client access the internal webserver the authentication runs correctly - but afterwards it is as if the authentication fails - the webserver writes 401 in the logfile.. Since it is SSL encrypted on the client side it is a bit hard to investigate in even thoguh I can see what we think we sends by dumping it out with tcpdump and decrypt with ssldump - but I am still not sure what is going wrong. Are there some common pitfalls here when we do a protocol-transition? best regards /tiCan I have social Open ID login along with the enterprise user login on the same page using F5 APM framework?
Folks, My team is using F5 APM framework for authentication mechanism in our system. I wanted to check the feasibility of a given solution as the screenshot listed below: We wanted to check if we can have social open id along with username textbox. Our developers suggest that this is not possible in F5 APM framework and they are suggesting to have radio buttons having the social sites and username. The user shall to select an option from radio button with either username or social id and then proceed next. Request you to let me know if the above screen design is possible. Kind Regards & Thanks.
