apm sso form-basedv2ΒΆ
apm sso form-basedv2(1) BIG-IP TMSH Manual apm sso form-basedv2(1)
NAME
form-basedv2 - Configures a single sign-on form-basedv2 configuration object.
MODULE
apm sso
SYNTAX
Configure the form-basedv2 component within the sso module using the syntax shown in the following sections.
CREATE/MODIFY
create form-basedv2 [name]
options:
app-service [[string] | none]
forms [add | replace-all-with] {
[name] {
request-value [URIs]
controls [add | replace-all-with] {
[name] {
value [string]
}
}
}
}
modify form-basedv2 [name]
options:
apm-log-config [[string] | none]
app-service [[string] | none]
forms [add | delete | modify | replace-all-with] {
[name] {
options:
app-service [[string] | none]
attribute-value [[string] | none]
controls [add | delete | modify | replace-all-with] {
[name] {
options:
app-service [[string] | none]
secure [true | false]
value [string]
}
}
description [[string] | none]
form-order [integer]
id-type [action | id | inputs | name | order]
request-method [get | post]
request-name [[string] | none]
request-negative [true | false]
request-prefix [true | false]
request-type [cookie | header | uri]
request-value [[string] | none]
submit-autodetect [true | false]
submit-javascript [[string] | none]
submit-javascript-type [auto | custom | extra]
submit-method post
submit-name [[string] | none]
submit-negative [true | false]
submit-prefix [true | false]
submit-type [cookie | header | uri]
submit-value [[string] | none]
success-match-type [cookie | none | url]
success-match-value [[string] | none]
}
}
headers [add | delete | modify | none | replace-all-with] {
[name] {
options:
app-service [[string] | none]
description [[string] | none]
name [string]
value [string]
}
}
log-level [alert | crit | debug | emerg | err | info | notice | warn]
edit form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
reset-stats
reset-stats [ [ [name] | [glob] | [regex] ] ... ]
DISPLAY
list form-basedv2
list form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
show running-config form-basedv2
show running-config form-basedv2 [ [ [name] | [glob] |
[regex] ] ... ]
options:
all-properties
non-default-properties
one-line
partition
show form-basedv2
show form-basedv2 [name]
DELETE
delete form-basedv2 [name]
DESCRIPTION
You can use the form-basedv2 component to configure an SSO form-basedv2 configuration object. When creating a new SSO form-
based v2 configuration object, you must add at least one forms item and within it at least one controls item. You must also
provide a value for the request-value option in the forms item.
The SSOv2 module identifies and processes two types of application HTTP requests - logon page requests and credentials
submit requests. Logon page requests are identified using the request- set of options. Credentials submit requests, in most
cases, are identified automatically. When this fails, you can set the submit-autodetect option to false and use the submit-
set of options to identify these requests.
When the SSOv2 module identifies a logon page request, it scans the response trying to find the logon form. If the logon
form is found, SSOv2 inserts a JavaScript code that will cause the logon form to be submitted automatically by the browser.
The client must support JavaScript.
When the SSOv2 module identifies a credentials submit request, it compares POST data parameter names with form controls
defined in the configuration. For a POST data parameter name that has a corresponding form control, the SSOv2 module
replaces its value with the control value from the configuration. Control values are usually supplied through session
variables, such as session.sso.token.last.username and session.sso.token.last.password. POST data parameters that have no
corresponding controls in the configuration are not changed.
The majority of web applications have a single logon page with one logon form. You will need to define a single forms item
for these applications. In rare cases when an application has multiple logon pages with different logon forms, you will
need to create multiple forms items, one for each logon page/form. If multiple logon pages use the same form, you will need
only one forms item with a list of URIs for all logon pages.
Every forms item must include at least one controls item, and can include up to 32 controls items. Each controls item
represents an input element of an HTML logon form, such as form fields for entering username and password, and, optionally,
any hidden form parameters. The name of the controls item must match the name attribute of the corresponding input tag of
the form. For example, if the form has the following HTML tag for entering the username:
the forms item must include a controls item with the name Bugzilla_login. The controls item used for entering the user's
password must have the secure option set to true. The value of a control item should usually be the name of a session
variable, starting with the percent (%) sign and enclosed in curly braces ({}); for example, the value for the username
control item: %{session.sso.token.last.username}. The value can also be a string, or a combination of strings and session
variable names.
EXAMPLES
create form-basedv2 fbssov2-owa2010 { forms add { owa2010 { controls add { password { secure true value
%\{session.sso.token.last.password\} } username { value %\{session.sso.token.last.username\} } } request-value
/owa/auth/logon.aspx\?replaceCurrent=1 submit-javascript clkLgn() submit-javascript-type extra success-match-type cookie
success-match-value sessionid } } }
Creates an SSO form-basedv2 configuration object named fbssov2-owa2010.
delete fbsso-owa2010
Deletes an SSO form-basedv2 configuration object named fbssov2-owa2010.
OPTIONS
app-service
Specifies the name of the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the application service that owns the object, you cannot modify or delete the
object. Only the application service can modify or delete the object.
forms
Specifies one or more items, each defining SSO processing of a separate application logon form.
[name]
Specifies the name of the form item. It does not have to match the actual name of the HTML form and can be arbitrary.
The options are:
app-service
Specifies the name of the application service to which the form item belongs. The default value is none. Note: If
the strict-updates option is enabled on the application service that owns the object, you cannot modify or delete
the form item. Only the application service can modify or delete the form item.
attribute-value
Specifies the value of the HTML