Forum Discussion

scsp_177450's avatar
scsp_177450
Icon for Nimbostratus rankNimbostratus
Apr 16, 2015
Solved

APM Access Policy -- Logout URI include

I have configured SSO and it works nicely except I cant logout!

 

Attempted defining this entry: Include Logout URI. But it just wont take my parameters.

 

The logout button points to "" so I entered "/index.php?logout=true". It just refused to accept. Any suggestion is much appreciated. Thanks.

 

BIG-IP Access Policy Manager (APM)
security
  • kunjan_118660's avatar
    kunjan_118660
    Apr 16, 2015

    It's a known issue. You may want to use an iRule as work around

    when HTTP_REQUEST {
  if { [HTTP::uri] equals "/index.php?logout=true" } {
    HTTP::redirect https://[HTTP::header host]/vdesk/hangup.php3 
  }
}

9 Replies

Sort By
  • scsp_177450's avatar
    scsp_177450
    Icon for Nimbostratus rankNimbostratus
    Apr 16, 2015
    It kept saying this: Configuration error: Configured URI (/index.php?logout=true) is not allowed to contain query parameter
  • kunjan_118660's avatar
    kunjan_118660
    Icon for Cumulonimbus rankCumulonimbus
    Apr 16, 2015

    It's a known issue. You may want to use an iRule as work around

    when HTTP_REQUEST {
  if { [HTTP::uri] equals "/index.php?logout=true" } {
    HTTP::redirect https://[HTTP::header host]/vdesk/hangup.php3 
  }
}
    • scsp_177450's avatar
      scsp_177450
      Icon for Nimbostratus rankNimbostratus
      Apr 16, 2015
      Hi Kunjan. Thanks. I was using redirect. But I think this is cleaner. It works well. Thanks!
    • amolari's avatar
      amolari
      Icon for Cirrus rankCirrus
      Apr 16, 2015
      IMHO using an irule here is not an equivalent. The session on the backend won't be logged out, only the APM session.
  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Apr 16, 2015

    It's a known issue. You may want to use an iRule as work around

    when HTTP_REQUEST {
  if { [HTTP::uri] equals "/index.php?logout=true" } {
    HTTP::redirect https://[HTTP::header host]/vdesk/hangup.php3 
  }
}
    • scsp_177450's avatar
      scsp_177450
      Icon for Nimbostratus rankNimbostratus
      Apr 16, 2015
      Hi Kunjan. Thanks. I was using redirect. But I think this is cleaner. It works well. Thanks!
    • amolari's avatar
      amolari
      Icon for Cirrus rankCirrus
      Apr 16, 2015
      IMHO using an irule here is not an equivalent. The session on the backend won't be logged out, only the APM session.
  • amolari's avatar
    amolari
    Icon for Cirrus rankCirrus
    Apr 16, 2015

    As written by Kunjan, it's a known issue: query parameter not supported (bug).

    Bug 226360 - [APM] Allow Query parameters in “Logout URI Include” field in access profile

    hopefully soon fixed

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Apr 16, 2015

    As amolari rightfully pointed out it won't remove the back end server session. Can we handle it in the response?

    when HTTP_REQUEST {
  if { [HTTP::uri] equals "/index.php?logout=true" } {
    set KO 1
  }
}
when HTTP_RESPONSE {
  if {[info exists KO] and $KO  } {
    HTTP::redirect /vdesk/hangup.php3 
  }
}