Forum Discussion

Member_9894's avatar
Member_9894
Icon for Nimbostratus rankNimbostratus
May 10, 2010

Login Banner

Hello.I've been tasked to create a login banner that will pop up when an external user hits my LTM and goes to any of my virtual servers. It's supposed to consist of a short message explaining that use of the system constitutes consent to monitoring and should have one button (yes/ok etc.) and the small x in the corner that would allow them to cancel out of the pop up (ideally this should close their connection or send them to an errorpage.) I believe this is possible with an iRule, but I have no experience with TCL. I would greatly appreciate any suggestions and help that anyone has to offer. Thanks in advance.

 

application delivery
dev
devops
iRules

8 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    May 11, 2010
    Hi Javern,

     

     

    What protocol are you load balancing through LTM? For HTTP, you could use a stream profile to inject Javascript which creates a popup in responses. We've discussed this type of response content injection in a few recent posts:

     

     

    http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/1171990/afv/topic/Default.aspx

     

    http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/29379/afv/topic/Default.aspx

     

    http://devcentral.f5.com/Default.aspx?tabid=53&aff=5&aft=1144860&afv=topic&afpgj=1

     

     

    Aaron
  • Reiss_79688's avatar
    Reiss_79688
    Icon for Nimbostratus rankNimbostratus
    Jun 28, 2010

    Hello, 

     

    I'm working with Member 9894 on this project. 

     

    What we are attempting to accomplish is present our users with a banner that says 'you are accessing our servers; you consent to monitoring, blah blah blah' and have them click on the 'OK' button to access the content. 

     

    Here's our basic setup... 

     

    multiple VS accessed via https...using PKI/CAC for client authentication. 

    using Big IP LTM v9.3.0 

     

    We would like to have Big IP serve the 'banner' page prior to the users being authenticated for any of our VSs. 

     

    I have attempted to use a 'HTTP::respond 200 content [subst $::html_data]'. I can get the page (basic html with embedded css) to be served but when clicking on the 'OK' button I'm not sure what happens at that point. 

     

    Any help would be appreciated. 

     

    I can post iRule scripting if needed; let me know.

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 28, 2010
    It should be relatively simple to implement a Javascript injection in responses. I think the trick is to figure out what code you want to inject and under which circumstances. For example, if this was the HTML for your index page:

     

     

    


My test index page


This is the rest of the HTML in the body...

     

     

    You could use a stream profile and STREAM::expression based iRule to replace < body > with < body > < script >alert('Click ok to access the page')< /script >:

     

     

    


My test index page



This is the rest of the HTML in the body...

     

     

    If you wanted to serve a page instead of Javascript, you could use logic like has been done in the maintenance page Codeshare examples. On any request (or any request to a login page), check for a cookie which the iRule sets upon clicking okay in a form. If the cookie is not set, redirect the client to /tos.html or some other page which is served from the iRule. On requests to that page, you send back the HTML for a banner page with an Accept button. The form action could be the same URI with a query string parameter set like /tos.html?accept=1. On requests to /tos.html?accept=1, you could redirect to the login page or the originally requested page and set a cookie indicating acceptable of the terms of service.

     

     

    Here are links to the maintenance page examples:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/LTMMaintenancePageGenerator.html

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/LTMMaintenancePage.html

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/Automatic_maintenance_page___Sorry_page_with_images.html

     

     

    Aaron
  • Reiss_79688's avatar
    Reiss_79688
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2010

    Thanks Aaron. Very good info. I was heading down those lines, but how do I get the iRule to capture the button click on my html page delivered to the user?

    Here is a snippet of what I have for the html on my tos.html page.

      I Agree

    This just seems to bring me back to the tos.html page.

    Also, the only way that I can see (with my limited knowledge of the Big IP traffic flow sequence and when the events are called) to do it is to have the iRule set a variable or cookie in the same conditional statement as the HTTP::respond. By doing this, though, the user won't actually have to click the 'I Agree' button to have the cookie or variable be set, instead, all they would have to do is visit the page. I would much rather know that they clicked the 'I Agree' button.

    Here is some of the iRule:

     when CLIENT_ACCEPTED {
set consent_monitor "NotAgree"
log local0. "CLIENT_ACCEPTED"
}
when HTTP_REQUEST {
 if { $consent_monitor == "NotAgree" } {
  log local0. "Client has not agreed to monitoring. Sending consent page..."
  set origUrl "[HTTP::host][HTTP::uri]"
  log local0. "original URL = $origUrl"
  HTTP::respond 200 content [subst $::html_data]
  
  set consent_monitor "Agree"
 }
}

    Any thoughts?...clear as mudd?

    Reiss
  • Reiss_79688's avatar
    Reiss_79688
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2010
    sorry about the format of my last post...i seem to be having trouble with the "code" section.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 01, 2010
    Hi Reiss,

     

     

    Can you attach the HTML as a text file to your post and remove it from the written part of the post? Or you might be able to put it in a [ code ] [/ code ] block to get the HTML to render inline.

     

     

    Thanks,

     

    Aaron
  • Al_3585's avatar
    Al_3585
    Icon for Nimbostratus rankNimbostratus
    Sep 06, 2012

    Reiss were you ever able to complete your login banner project? We have a similar need and would like to use it if you got it working. Trying not to "re-invent the wheel". Thx!