Single Sign on from Full Webtop to second VS with Full Webtop

I think we cannot chain APMs webtop without doing heavy cookie rewriting. Could you try to use webtop link pointing to you Citrix VS passing credentials through the url ? you could setup your link like this : http://vs citrix ip/?login=%{session.logon.last.username}&password=%{session.logon.last.mypassword}

and add a variable assign to setup session.logon.last.mypassword just before resource assign.

password would be clear text for the moment, but if it's working we can move to another step.

OK, so just to make sure I understand you. You want to get the credentials over to the second VS, and you are doing this by including them in the URL. Then I would have to write an iRule that will extract the credentials from the URL and dump them into session.logon.last.username and session.logon.last.password variables in this second VS? Any advice on the iRule I would need to do this?

Thanks Tony

Actually, wrote an iRule that makes this work:

when ACCESS_SESSION_STARTED {

set username [URI::query [HTTP::uri] username]

set password [URI::query [HTTP::uri] password]

ACCESS::session data set session.logon.last.username $username

ACCESS::session data set session.logon.last.password $password

}

So now the next question is how do I encrypt this and keep things safe?

Tony, we could propose an alternative, instead of having username/password in the query we could just send the APM session id which can be used to retrieve username and password.

1. i change the webtoplink to http://10.0.10.40/?id=%{session.user.mysid}

2 . on first vs if use this irule :

when ACCESS_SESSION_STARTED {
    log local0. "vs [IP::local_addr] newsid [ACCESS::session sid]"
    ACCESS::session data set session.user.mysid [ACCESS::session sid]
}

3 . on second vs (citrix for you) i use this irule :

when ACCESS_SESSION_STARTED { 

set firstvssid [URI::query [HTTP::uri] id]
log local0. "vs [IP::local_addr] firtsid $firstvssid"
setting first session username into existing session
ACCESS::session data set session.logon.last.username [ACCESS::session data get -sid $firstvssid session.logon.last.username]
setting first session password into existing session
ACCESS::session data set session.logon.last.password [ACCESS::session data get -sid $firstvssid -secure session.logon.last.password]

}

Thanks for this Arnaud

I'm close to getting this working, but there is an error in your second iRule. It is to do with the "-secure" part. If I remove that the error goes away, but the password is hashed and I can't use it. The error in the logs is this:

01220001:3: TCL error: /Common/SID_TRANSFER_DESTINATION_VS - variable lookup failed (line 1)Illegal argument (line 1) (line 1) invoked from within "ACCESS::session data get -sid $firstvssid -secure session.logon.last.password"

Let me know what you think.

Thanks Tony

syntax should be ok, whatever i'm still struggling with the -secure option and i can't get a working end to end configuration. i managed to get it working with following modifications: i changed the irule on the second VS by :

when ACCESS_POLICY_AGENT_EVENT { 

set myuri [ACCESS::session data get  session.server.landinguri]
set firstvssid [URI::query $myuri id]
log local0. "vs [IP::local_addr] firtsid $firstvssid"

setting first session username into existing session
ACCESS::session data set session.logon.last.username [ACCESS::session data get -sid $firstvssid session.logon.last.username]
setting first session password into existing session
ACCESS::session data set -secure session.logon.last.password [ACCESS::session data get -sid $firstvssid session.logon.last.mypassword]

}

1. on the first VS policy i added a variable assign following logon page : session.logon.last.mypassword = mcget -secure {session.logon.last.password}

2. one the second vs policy i added a irule event just after the start

Yup, this is working perfectly for me! Thanks so much for your help!