Bernard_9290
Nimbostratus
NimbostratusSSL::session invalidate issue
BIG-IP version:10.2.0 HF1
We have a virtual server with a client SSL profile configured for mutual authentication and we would like to invalidate the SSL session when the user logs out from the associated application by using an iRule.
To do that, we execute "SSL::session invalidate" in the http_request event when matching the logout URI (/f5logout).
The session is successfully invalidated only if the "SSL::session invalidate" command is not followed by a redirection or "http::respond".
Otherwise, the session remains active. It means that the user doesn't have to renegotiate a SSL session (provides the password protecting the private key) if he wants to logs in again in the application.
Any idea if there is restriction in the "SSL::session invalidate" command usage?
The iRule...
when HTTP_REQUEST {
switch [HTTP::uri] {
"/f5logout" {
drops the session from the session cache to prevent reuse of the session
SSL::session invalidate
HTTP::redirect "http://domain2"
return
}
}
insert specific X509 information in header
HTTP::header insert "DN" [X509::subject [SSL::cert 0]]
insert the entire client certificate in header
HTTP::header replace SSLClientCert [b64encode [SSL::cert 0]]
}
Bernard
