Forum Discussion

VB_95896's avatar
VB_95896
Icon for Nimbostratus rankNimbostratus
Jan 06, 2010

SSL only when auth - HTTP>SSL>HTTP

Hi,

 

 

I'd like to (re)produce the following behavior :

 

 

When a client sends an HTTP request to a website called "host", the intermediate BigIP requires an SSL connexion (redirect client to HTTPS://host). The BigIP then asks the login and password of the client (there is an LDAP authentication profile on the HTTPS virtual server). Then, if the authentication is successful (AUTH_SUCCESS), the BigIP allow the client to connect to the website "host" using HTTP (redirect to http://host).

 

 

The purpose of this is to confine the use of SSL to the authentication process.

 

 

Here is my target configuration :

 

 

STEP1 :

 

A virtual server "HTTP_1" to which the client sends a 1st HTTP request (URL = HTTP://host/f5). "HTTP_1" redirects the client to HTTPS://host/ (with an iRule).

 

 

STEP2 :

 

A virtual server "HTTPS_1" to which are sent the requests to HTTPS://host/. "HTTPS_1" should redirect the client to HTTP://host only if the authentication is successful (AUTH_SUCCESS).

 

 

STEP3 :

 

The virtual server "HTTP_1" collects the HTTP request destined to HTTP://host (profile) and forwards them to the pool containing the "host".

 

 

 

I manage step 1 and 3 but fail to produce step 2. I can't find an iRule doing step2...

 

 

 

Thanks for your help.

 

 

Regards,

 

 

 

Vincent

 

application delivery
dev
devops
iRules

1 Reply

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 07, 2010
    Hi Vincent,

     

     

    If the two VIPs are on the same domain, you could use a cookie to track that the client has successfully authenticated against the auth server and redirect the client to the HTTP VIP. You could then check for that cookie on the HTTP VIP before redirecting the client back to HTTPS. From a security standpoint, you could try encrypting the client User-Agent header value with a timestamp and use that for the cookie. On requests, if the cookie value can be decrypted, the user-agent header from the cookie matches the client's user-agent and the timestamp is newer than some session timeout value, you would consider the auth cookie as valid.

     

     

    Also, in 9.4+ the four AUTH_ events have been deprecated in favor of a single event, AUTH_RESULT (Click here).

     

     

    You can get a few examples from the Codeshare for doing auth:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/ClientAuthUsingHTMLForms.html

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/ClientAuthUsingHttpCookie.html

     

     

    And you can check the default LDAP auth rule, _sys_auth_ldap.

     

     

    Aaron