iRule with JSESSIONID including the server id with jvmRoute
Dears, unfortunately I did not find a fitting post to my problem: We have two or more servers they creating a JSESSIONID where the id of the server is added on the end like so: 7B0DE3926CF23C27DFF9C80BE604B009.serverID0 5C38A6262816E6E3A6BBB0B3ABB42D3A.serverID1 (we are using the-DjvmRoute=... on the tomcat) Is it possible, that every JSESSIONID with the ending serverID0 is always routing to server 0 and serverID1 to server 1? The rootcause is, that if the routing switches for a user, they logged in 3 days before, they has to loggin again, although there is a valid security context on tomcat available on the "right" server...
Multisession among Tomcat servers and its synchornization
Hello everyone, me and my coleague are new users of our first F5 LTM and we are also new to this forum. We have support for this device but so far we have no answer since last week and project should move forward... Anyway, we've encountered simultaneous login issue. Introduction: We're using bigip to load balance java based web apps. It does load balancing based on jsessionid for java apps deployed on tomcat. We can say that we deployed standard environment with BIG-IP, Tomcat, Apache and persist sessions We run one port on our tomcat instances (8080) we allow only for https "secure" traffic. Bigip handles the https offload. Http "unsecure" requests are redirect to https We use oneconnect We parse certain POST request and insert user login and organization_unit into jsesssionID cookie Issue description: How it works without LB: User is logging into application. Tomcat instance "combine" new session with login. The general idea is to prevent simultaneous user login. In case when user is trying to log into from another "machine" and Tomcat detect that login is connected with another session user can decide what to do: log in and close old session or resign. Issue with LB: Tomcat instances haven't common sessions pool. Instances work independently. Clustering or session replication hasn't been configured. I wonder whether it is possible to achieve such functionality using LB or how to send list of all persist sessions from LB to tomcat instances. We know that we are able to collect those information using "show ltm persistence persist-records virtual Virtual-Server-ID all-properties" but this approach require console access and it doesn't fulfill our expectations. Would you please suggest other solution? Kind Regards, Filip
APM Kerberos/SPNEGO to Tomcat (CAS)
We are working on setting up SPNEGO authentication with Apereo CAS (https://apereo.github.io/cas/4.2.x/index.html) running on Linux, and I have a few things I would like clarification on. We need APM to present a logon page to a user, and then use Kerberos to authenticate them to the CAS server. It looks like a user account is required for the CAS service, and that ktpass.exe must be used to export the keytab file for that user. Here are the questions I have: How many Active Directory user accounts are needed for this? I assume we need a delegation account for the F5s, and we also need a service account for CAS. Or do we need to use the same delegation account for the CAS service as well? If two accounts are needed, what do the corresponding SPNs need to be? Here is the hostname information: castst.company.com - URL of the application that users will be accessing. Points to an F5 VIP. castst01.company.local - Hostname of CAS server. Refuses any traffic not for castst.company.com, forcing users to go through the F5. For the delegation account, would I set the SPN to be HTTP/castst.company.com@COMPANY.LOCAL? And then for the service account set it to be HOST/castst01.company.local@COMPANY.LOCAL? Thanks in advance. P.S. Specific documentation regarding the CAS configuration can be found here: https://wiki.jasig.org/display/CASUM/SPNEGO https://apereo.github.io/cas/4.2.x/installation/SPNEGO-Authentication.html
AN IRULE THAT ADDS A STRING AS AN HTTP RESPONSE TO ANY POOL MEMBER CHOSEN BY THE F5
I need to load balance an application running on two pool members, 172.30.114.56:8080, 172.30.114.58:8080; However, on the two, i only get the page, "Tomcat is running". However,the service only loads when i type either, 172.30.114.56:8080/arsys, or 172.30.114.58/arsys. I need an irule that can add a string to the http response, such that, after the load-balancing decision,the string /arsys is added so, the page can load. I don't know if the Stream Profile can work for this. I tried the below irule, but its not working. NOTE: VIP is 172.30.114.60. when HTTP_REQUEST { if { [HTTP::host] equals "172.30.114.60" and [HTTP::uri] starts_with "/" } { HTTP::redirect ";; } } The requirement is that the service is to be accessed over https,but i still want to test basic http vip for it,172.30.114.60, but its not loading currently to any of the servers,APM swallowing JSESSIONID cookie; workaround possible by copying cookie to return stream?
Hi, all - we have a layer 7 VIP secured with an APM policy. The VIP proxies to a Tomcat server, which returns a JSESSIONID cookie after user logon. Sporadically, the F5 does not return the JSESSIONID to the client; it will be working fine for a a few days, then it will kick into a mode where users logon but don't have a Tomcat session tracked to their logon, because they simply don't have a JSESSIONID cookie anymore to send with their next request. This is similar to what was noted by Davo T, here: https://devcentral.f5.com/questions/apm-sso-config-using-kerberos-to-weblogic-backend-not-supplying-session-id-cookie-on-post-authentication-requests I'm working this as a case with F5 - but while it's being worked, is there a reliable way to script an explicit copying of the JSESSIONID cookie from the returned stream from the real server, before APM gets its hands on it, then insert it into the reply after APM is done processing? What events would I reference in an iRule to accomplish that? I'm not super familiar with the APM-related event lifecycle, and how it expresses itself in iRules. In case it matters, the policy in question does the following: - presents a login page, obtains userid, RSA PIN/Code - RADIUS auths against an RSA server - checks a RADIUS filter-id attribute value - checks the URL against an ACL Thank you!503 error when trying to use modJK and F5 tomcat pool
Hello all I am having an issue trying to use mod_JK to mount a f5 load balanced pool, the pool itself when hit will respond and show content but when I use JK mount it will not (I have allowed on all ports) showing a 503 "Service Temporarily Unavailable" can someone please help as this is deeply annoying me. Thanks ZX Virtual server config Name poolname_HTTP_http_virtual Application poolname_HTTP Partition / Path TEST-Traffic- Partition/poolname_HTTP.app Description Type- Standard Source- 0.0.0.0/0 Destination- Host internal IP Service Port 0 Availability Available (Enabled) - The virtual server is available worker.feed file worker.worker2.connect_timeout=20000 worker.worker2.prepost_timeout=20000 worker.worker2.socket_timeout=1 worker.worker2.reply_timeout=20000 worker.worker2.type=ajp13 worker.worker2.host=LB_POOL_ADDRESS worker.worker2.port=8009 mod_jk.log [Mon Jan 27 16:05:21.575 2014] [3299:47758934280512] [info] ajp_handle_cping_cpong::jk_ajp_common.c (929): timeout in reply cpong [Mon Jan 27 16:05:21.577 2014] [3299:47758934280512] [error] ajp_connect_to_endpoint::jk_ajp_common.c (1035): (worker2) cping/cpong after connecting to the backend server failed (errno=110) [Mon Jan 27 16:05:21.577 2014] [3299:47758934280512] [error] ajp_send_request::jk_ajp_common.c (1630): (worker2) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=110) [Mon Jan 27 16:05:21.577 2014] [3299:47758934280512] [info] ajp_service::jk_ajp_common.c (2607): (worker2) sending request to tomcat failed (recoverable), because of error during request sending (attempt=2) [Mon Jan 27 16:05:21.577 2014] [3299:47758934280512] [error] ajp_service::jk_ajp_common.c (2626): (worker2) connecting to tomcat failed. [Mon Jan 27 16:05:21.577 2014] [3299:47758934280512] [info] jk_handler::mod_jk.c (2678): Service error=-3 for worker=worker2AN IRULE THAT ADDS A STRING TO HTTP REQUEST OR RESPONSE (POOL MEMBER ALONE DOESN'T LOAD)
I got a request from a customer for ssl offload to their website.(using tomcat engine) Ordinarily, this isn't hard. However, their pool members don't load on their ip:port combination. Both pool members are 172.30.114.56:8080, and 172.30.114.58:8080. However, none of them loads as a webpage, when type that on my browser. They only work when 172.30.114.56:8080/arsys OR 172.30.114.58:8080/arsys, is typed into the browser. What irule, can i use to add a string to any pool member chosen. Like, if 172.30.114.56:8080 is chosen, it will automatically return, 172.30.114.56:8080/arsys, or 172.30.114.58:8080/arsys. I tried the below irule, but its not working. NOTE: VIP is 172.30.114.60. when HTTP_REQUEST { if { [HTTP::host] equals "172.30.114.60" and [HTTP::uri] starts_with "/" } { HTTP::redirect "http://172.30.114.58:8080/arsys"; } } I want to try this for http VS first, to test its usability,then use it for HTTPS.