BigIP APM 12.1.3: username variable session.logon.last.username empty

Question

variable was working in 11.5.&nbsp;
variable is working in chrome and firefox.&nbsp;
variable is not working in IE 11.&nbsp;
Any clues?&nbsp;
variable is used in an AD Query:&nbsp;
(sAMAccountName=%{session.logon.last.username})&nbsp;

joethefifth · Answer

I have an irule which triggers an access policy based on a condition =&gt; $EnableAPMPolicy equals 1
 when HTTP_REQUEST {
ACCESS::disable     
if { $EnableAPMPolicy equals 1 } {       
    ACCESS::enable
}

}
So by default I set ACCESS::disable in the HTTP_REQUEST.
This was preventing IE from getting the username variable somehow.
I added a condition which only calls ACCESS:disable if $PolicyEnabled = 0 
Now IE is happy and variable is passed along.
     when HTTP_REQUEST {

if { $EnableAPMPolicy equals 0 } {       
    ACCESS::disable
}

if { $EnableAPMPolicy equals 1 } {       
    ACCESS::enable
}

}

joethefifth · Answer

After some tests this configuration interferes with office web apps. I have to keep the access:disable by default. 
Anyone know why this prevents IE from passing the session variable in APM?&nbsp;

stanislas_piro2 · Answer

Is this configuration enabled on the same VS you applied APM Sharepoint Authentication code?&nbsp;
If Yes, I recommend to use version 2 of the code which allow you to manage APM disable in the first HTTP_REQUEST event (lines 50-97).&nbsp;
don't create another irule but edit this one to manage Authentication. &nbsp;
I guess you can manage office web apps by Host header to disable APM.&nbsp;

joethefifth · Answer

This issue is becoming very serious now. 
I have confirmed two configurations where IE11 does not work:&nbsp;
Config A:
1. You have a VS with an APM Policy starting with a logon page, a message box to show the username entered in the logon page and an ldap or ad auth.&nbsp;
You add an irule on this VS with an Access::disable in the beginning of the http_request and an Access:Enable only if some condition is met.
In this case apm shows an empty value in the user name and of course password is empty too.
If you remove the access:disable IE does capture and transfer the username/password.&nbsp;
Config B:&nbsp;
You create 2 VSsOn first VS add an irule with a redirect to the second VS if some condition is met.You add an APM policy to the second VS, same VPE =&gt; logon page, messagebox, auth.
In this case IE does not work.&nbsp;
In both configs Chrome and Firefox work fine.&nbsp;
I have found some info here and there about APM/IE blank values:
https://support.f5.com/csp/article/K04732437
https://support.f5.com/csp/article/K16109&nbsp;
Anyone to test/confirm or offer a solution/bypass?
Thanks.&nbsp;

joethefifth · Answer

Anyone?&nbsp;

Forum Discussion

BigIP APM 12.1.3: username variable session.logon.last.username empty

7 Replies

Recent Discussions

Client certificate Authentication - open multiple tabs

google autenticator broken barcode

Chrome V 124+ on MacOS - Virtual Server Access Issue

vulnerabilities (CVE-2020-36363), CVE-2016-0736,CVE-2019-6593-FOR VERSION BIGIP LTM-16.1.4

Port Group on F5OS network setting

Related Content

APM variable assign examples

iRule variable

Getting Started with iRules: Variables

Office 365 Logon Enhancement – Username Capture

Persist connection based on NTLM username