OWA with external logon page and SSO select

Hi there,

 

 

I have been trying to setup OWA with a custom logon screen to allow the various flags to be set for Light, Public and Private, and then depending on the flags set to select the appropriate SSO settings. This logon page is hosted on the F5 using iFiles.

 

 

The initial VS deployment was done using the iApp template: f5.microsoft_exchange_2010_cas.2012_04_06 and we are using OWA, Outlook Anywhere, ActiveSync and Autodiscover and are running 11.1.0 HF3

 

 

This is working to a large extent but only if the user goes straight to the logon page (which is hosted on a different port).

 

 

User connects to https://mail.acme.com:8443/owa_custom_logon

 

User submits credentials which are posted to a fake URI on https://mail.acme.com/owa_fake_capture , an iRule is in place to capture the content and populates a number of variables:

 

The iRule is:

 

when HTTP_REQUEST {

 

check for post request

 

set url 0

 

if {[HTTP::uri] starts_with "/owa_fake_capture" and [HTTP::method] eq "POST"}{

 

The above URI ???/??? should be true based on the iFiles LOGON.ASPX file POST contents

 

Ensure this is the case

 

set url 1

 

set my_content_length [HTTP::header "Content-Length"]

 

HTTP::collect $my_content_length

 

}}

 

 

when HTTP_REQUEST_DATA {

 

Set the collected POST variables into keys in the LTM session table

 

if { $url ==1} {

 

table set key_owa_flags [findstr [HTTP::payload] flags 6 "&"] 0 indefinite

 

table set key_owa_trusted [findstr [HTTP::payload] trusted 8 "&"] 0 indefinite

 

table set key_owa_username [findstr [HTTP::payload] username 9 "&"] 0 indefinite

 

table set key_owa_password [findstr [HTTP::payload] password 9 "&"] 0 indefinite

 

HTTP::release

 

redirect is required as user landing uri was /owa_fake_capture

 

HTTP::redirect https://mail.acme.com/owa

 

}}

 

 

APM kicks in and using the captured variables signs the user in and gets them into the appropriate SSO using WEBSSO::select depending on the flags set.

 

 

If a user was to go directly to https://mail.acme.com/owa APM would deny access as there is no logon page configured in the VPE.

 

 

Now what I was trying to do was to add an external logon page to the VPE, and modifying the external logon page to post to /my.policy, which would do the following:

 

 

User connects to https://mail.acme.com/

 

User is redirected to https://mail.acme.com/owa

 

APM kicks in and user is sent to external logon page on https://mail.acme.com:8443/owa_custom_logon, APM is expecting username and password to be posted to post_url https://mail.acme.com/my.policy (according to the documentation)

 

User submits credentials which are posted to https://mail.acme.com/my.policy , an iRule is in place to capture the additional content.

 

The iRule is:

 

when HTTP_REQUEST {

 

check for post request

 

set url 0

 

if {[HTTP::uri] starts_with "/my.policy" and [HTTP::method] eq "POST"}{

 

The above URI ???/??? should be true based on the iFiles LOGON.ASPX file POST contents

 

Ensure this is the case

 

set url 1

 

set my_content_length [HTTP::header "Content-Length"]

 

HTTP::collect $my_content_length

 

}}

 

 

when HTTP_REQUEST_DATA {

 

Set the collected POST variables into keys in the LTM session table

 

if { $url ==1} {

 

table set key_owa_flags [findstr [HTTP::payload] flags 6 "&"] 0 indefinite

 

table set key_owa_trusted [findstr [HTTP::payload] trusted 8 "&"] 0 indefinite

 

table set key_owa_username [findstr [HTTP::payload] username 9 "&"] 0 indefinite

 

table set key_owa_password [findstr [HTTP::payload] password 9 "&"] 0 indefinite

 

HTTP::release

 

redirect is not required as users landing uri is /owa

 

}}

 

 

However nothing else is captured by the F5 (I enabled logging at various stages in the iRule and it just returns with blank entries). Username and Password are captured but I suspect that is the workings of the javascript it inserts when redirecting the user to the external logon page and the fact that APM has started.

 

 

I realise I could setup a separate VS for OWA (https://owa.acme.com) capture the creds there and then redirect them to the APM enabled VS (https://mail.acme.com), but I would prefer to have everything under the one.

 

 

Has anyone else found a nice way around this?