Forum Discussion

_Mo__2's avatar
_Mo__2
Icon for Nimbostratus rankNimbostratus
Sep 11, 2018

Get the wrong account on the application after two logon attempts

Hi Guys,

 

After a wrong log in with a bad password again the box AD Auth, I do a right log in with an other username and I get the account of the previous people on the backend.

 

Indeed, the authentication on the backend and the application is based on an HTTP Header built by the F5 from the information of session.ad.last.attr.UserPrincipalName get by an AD Query.

 

The mechanism:

 

I create a custom variable session after the logon page with session.logon.last.username@domain and I use this new custom variable to lookup in the AD with an AD Query after the AD Auth. I get the UserPrincipal Name to built the HTTP Header afterward.

 

Problem

 

I get the account of the previous people on the backend. It seems we have some caching during the APM Workflow when I change the account with a right password against the Ad Auth for the second attempt.

 

Do you why the APM Workflow keep my custom variable in cache ?

 

Thanks a lot for your help.

 

Morgan

 

APM
security

2 Replies

Sort By
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Sep 11, 2018

    Hi Morgan,

     

    I already encounter this kind of behaviour because of the location of "variable Assign".

     

    Can you set up your " Variable Assign" after AD auth then try again?

     

    keep me update if you need more details.

     

    regards,

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 11, 2018

    Hi,

    the problem is when your policy is like that:

    start --> logon page --> variable assign --> AD auth
    • First authentication logon page is managed in Logon page box
    • all other authentication attempts are managed within AD auth box... there is not backward in decision tree.

    So every decision between logon page and AD auth are evaluated only once during first authentication.

    To solve the issue,

    • create a macro with "loop count" define to 3
    • configure the same policy within this macro. except that you define the AD auth max attempts to 3.
    • connect AD auth failure to loop ending.

    the macro will force to evaluate again every box during next authentication attempts.