APM session username/password vars not copied in from iRule? Not showing in session report, and auth always fails

1. Make sure you have the "ACCESS::restrict_irule_events disable" in an iRule on CLIENT_ACCEPTED. This will make sure that your iRule is actually executing while the policy is under evaluation.

    

2. Assuming that your iRule is working before the policy evaluation and you are still not getting the results, I can suggest a different approaach. a. Put the "Landing URI" policy element as the first check in the policy so that you ensure policy evaluation. b. Put an iRule event policy element as the second thing in the policy.

    

Step b will trigger the ACCESS_POLICY_AGENT_EVENT in the iRule which you will have to apply on the virtual. In this iRule you have access to the entire payload using the session variable session.server.initial_req_body.

Now since you are in the middle of the policy evaluation you can access both the HTTP content as well as APM session variables before you end the policy in an Allow or Deny.

Take a look at "ACCESS::session data get|set"

Best !!

Thank you, Amit - adding the "ACCESS::restrict_irule_events disable" didn't have any effect (in and of itself, but I left it in for your 2nd part, just in case).

I think I may be running into security restrictions on setting session.logon.last.password (" target="_blank">discussed here). I did your part 2 (though the HTTP:: vars weren't accessible in ACCESS_POLICY_AGENT_EVENT, so i had to create irule vars in ACCESS_SESSION_STARTED and copied from those). Then in the policy, i have a var assignment agent to copy those session.custom.username/password vars to session.logon.last.username/password. That gets me farther - the LocalDB auth agent at least checks the correct userid now. BUT - the password value appears not to have assigned. The password check always fails.

In the session report, I get an error msg like:

LOCALDB agent: (logon attempt:0) authenticate with '$CK$8JkcxNSl$6pu1Rjb3KxeNCSl7TmYsdQ==' failed

I'm not sure what that hash is ... but I do know I'm entering the correct password, and in the iRule that password is correctly present in the irule var that I assign to session.custom.password.

Hmm. Did something change in recent versions in session variable security protections or something?

Hmm. As a test, I replaced the policy with a simple one that uses a default logon page and LocalDB Auth agent - and it works. So nothing obvious wrong with my LocalDB or user accounts.

Comparing the sessions, using the logon page vs. clientless - during the LocalDB Auth agent processing, the clientless session report shows the following line:

LOCALDB agent: (logon attempt:0) authenticate with '$CK$WjQg31Du$NFM7lGxd9YAawb4+ZTwpcA==' failed

In its place in the similar report when using the logon page is simply "Username 'FISERV'" and nothing else. Maybe you need to prime vars other than session.logon.last.username and session.logon.last.password?