This code allow to configure certificate authentication with APM clientless-mode support.
The APM behavior when configuring following condition is to disable clientless-mode :
This code enable clientless mode if required based.
PS : this code use a list instead of a simple variable to be included in APM Sharepoint authentication code without changes.
Edit the first HTTP_REQUEST event and add condition for enabling certificate authentication.
I have a situation that might be able to use this, but we do have an On-Demand Certificate Authentication in our APM policy. We now have a requirement to connect to this VIP on a specific URL for a SOAP-based web service. Unfortunately, the POST method with the SOAP payload is encountering the 302 redirects to /my.policy. By the time it gets to back to the original SOAP endpoint, the request has become a GET and the payload is no longer being transmitted.
Also, we are trying to do this with mutual TLS, but because of the On-Demand Certificate Authentication, the client certificate is not requested until at least the 3rd redirect (the one with my.policy?nonce=?????). Is there no way around this?
Thanks in advance for any direction you might be able to point me towards,
This code usage is to not add a On-Demand Certificate Authentication box but only a Client Cert Inspection box. This irule manage the certificate request.
If you add a On-Demand Certificate Authentication box, it breaks the clientless mode.
Thanks. What if you just want to allow this for specific users? For example, allow a certain Common Name based on the client certificate supplied?
@jkreyes : This code manage clientless authentication for APM and import CN in session.logon.last.cn variable.
you can filter in APM based on this variable.
@stanislas. Thank you for the clarification. I am a little late getting back to you, but our F5 folks decided it was too clunky to squeeze both use-cases (requiring on-demand client cert and MTLS for web services) onto the same Virtual Server. So we are going with an HAProxy or a separate VIP.