Forum Discussion

Stefan_Klotz_85's avatar
Stefan_Klotz_85
Icon for Cirrus rankCirrus
Sep 04, 2015

SSO with different subdomain and APM 10.2.4

We are running an APM on 10.2.4 and an upgrade to version 11 is not an option right now. We configured it for OWA and this working fine. Now we want to extend the OWA functionality with the Enterprise Vault plugin (archives for emails). The hostname/DNS for the EV-servers is a different sub-domain, but pointing to the same VIP-address as OWA, e.g.

 

  • OWA: owa.company.com
  • EV1: ev1.company.com
  • EV2: ev2.company.com

Now when clicking the EV-link within OWA, I'm getting the APM logon page displayed again or the error message that there is already an active session running bla bla.

 

I know in version 11 there is the possibility to specify multi-domain for the APM policy, but that's not available in version 10. So how did I get it working to share the OWA credentials also for the EV-servers? Is it possible t share it across the same VIP or do we have to create a dedicated one for the EV-DNS-names?

 

Thank you!

 

Ciao Stefan :)

 

APM
deployment
security

4 Replies

Sort By
  • Stefan_Klotz's avatar
    Stefan_Klotz
    Icon for Cumulonimbus rankCumulonimbus
    Sep 10, 2015

    I found the Share Access Cookies article and tried to adjust it based on our setup, especially as we only use ONE virtual server, so no redirection is required. We only need to adjust the MRHSession cookie to be valid for all subdomains, meaning ".company.com". Additionally the EV-servers are using a different SSO method than OWA, so I tried to fix this with the "WEBSSO::select"-command for the appropriate request, but this doesn't seem to trigger. Anyone an idea how to solve this issue, maybe also with some workarounds? Thank you!

     

    Ciao Stefan :)

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 10, 2015

    Hi,

    owa.company.com, ev1.company.com and ev1.company.com are in different subdomain but in the same : company.com (without dot at the beginning)

    if you change SSO domain to company.com, every fqdn in company.com will share MHR session.

    to change SSO profile based on hostname, you can use :

    when ACCESS_ACL_ALLOWED {
    switch [string tolower [HTTP::host]] {
        "ev1.company.com" {WEBSSO::select Basic}
        "ev2.company.com" {WEBSSO::select Form-ev2}
    }
}
  • Stefan_Klotz's avatar
    Stefan_Klotz
    Icon for Cumulonimbus rankCumulonimbus
    Sep 11, 2015

    Hi Stanislas,

     

    I entered "company.com" in the Domain Cookie field of the APM policy and this works perfectly fine. The MRHSession- and LastMRH_Session-cookie are now stored only with company.com.

     

    But for the EV-plugin I'm still getting a 401. Interesting when verified with FF "Live HTTP headers" add-on I see two requests towards the ev DNS-name, the first one is answered with a 200 OK, but the second with a 401 (WWW-Authenticate: NTLM). I'm currently checking with application team, as I'm not sure if this is still a LB issue or somehow related to the application.

     

    Thank you so far!

     

    Ciao Stefan :)

     

  • Stefan_Klotz's avatar
    Stefan_Klotz
    Icon for Cumulonimbus rankCumulonimbus
    Sep 25, 2015

    Hi again,

     

    we could solve the issue in the meanwhile. The problem was that for processing OWA authentication and SSO the domain was added as prefix via variable assignment. But the SSO for NTLM just needs the username, so we enabled the option "Username Conversion" in the NTLM SSO-profile.

     

    So switching the SSO-profile the way how Stanislas described it in his answer was the only real trick required.

     

    Thank you!

     

    Ciao Stefan :)