apm sso form-basedv2¶
apm sso form-basedv2(1) BIG-IP TMSH Manual apm sso form-basedv2(1)
NAME
form-basedv2 - Configures a single sign-on form-basedv2 configuration
object.
MODULE
apm sso
SYNTAX
Configure the form-basedv2 component within the sso module using the
syntax shown in the following sections.
CREATE/MODIFY
create form-basedv2 [name]
options:
app-service [[string] | none]
forms [add | replace-all-with] {
[name] {
request-value [URIs]
controls [add | replace-all-with] {
[name] {
value [string]
}
}
}
}
modify form-basedv2 [name]
options:
apm-log-config [[string] | none]
app-service [[string] | none]
forms [add | delete | modify | replace-all-with] {
[name] {
options:
app-service [[string] | none]
attribute-value [[string] | none]
controls [add | delete | modify | replace-all-with] {
[name] {
options:
app-service [[string] | none]
secure [true | false]
value [string]
}
}
description [[string] | none]
form-order [integer]
id-type [action | id | inputs | name | order]
request-method [get | post]
request-name [[string] | none]
request-negative [true | false]
request-prefix [true | false]
request-type [cookie | header | uri]
request-value [[string] | none]
submit-autodetect [true | false]
submit-javascript [[string] | none]
submit-javascript-type [auto | custom | extra]
submit-method post
submit-name [[string] | none]
submit-negative [true | false]
submit-prefix [true | false]
submit-type [cookie | header | uri]
submit-value [[string] | none]
success-match-type [cookie | none | url]
success-match-value [[string] | none]
}
}
headers [add | delete | modify | none | replace-all-with] {
[name] {
options:
app-service [[string] | none]
description [[string] | none]
name [string]
value [string]
}
}
log-level [alert | crit | debug | emerg | err | info | notice | warn]
edit form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
reset-stats
reset-stats [ [ [name] | [glob] | [regex] ] ... ]
DISPLAY
list form-basedv2
list form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
show running-config form-basedv2
show running-config form-basedv2 [ [ [name] | [glob] |
[regex] ] ... ]
options:
all-properties
non-default-properties
one-line
partition
show form-basedv2
show form-basedv2 [name]
DELETE
delete form-basedv2 [name]
DESCRIPTION
You can use the form-basedv2 component to configure an SSO form-basedv2
configuration object. When creating a new SSO form-based v2
configuration object, you must add at least one forms item and within
it at least one controls item. You must also provide a value for the
request-value option in the forms item.
The SSOv2 module identifies and processes two types of application HTTP
requests - logon page requests and credentials submit requests. Logon
page requests are identified using the request- set of options.
Credentials submit requests, in most cases, are identified
automatically. When this fails, you can set the submit-autodetect
option to false and use the submit- set of options to identify these
requests.
When the SSOv2 module identifies a logon page request, it scans the
response trying to find the logon form. If the logon form is found,
SSOv2 inserts a JavaScript code that will cause the logon form to be
submitted automatically by the browser. The client must support
JavaScript.
When the SSOv2 module identifies a credentials submit request, it
compares POST data parameter names with form controls defined in the
configuration. For a POST data parameter name that has a corresponding
form control, the SSOv2 module replaces its value with the control
value from the configuration. Control values are usually supplied
through session variables, such as session.sso.token.last.username and
session.sso.token.last.password. POST data parameters that have no
corresponding controls in the configuration are not changed.
The majority of web applications have a single logon page with one
logon form. You will need to define a single forms item for these
applications. In rare cases when an application has multiple logon
pages with different logon forms, you will need to create multiple
forms items, one for each logon page/form. If multiple logon pages use
the same form, you will need only one forms item with a list of URIs
for all logon pages.
Every forms item must include at least one controls item, and can
include up to 32 controls items. Each controls item represents an input
element of an HTML logon form, such as form fields for entering
username and password, and, optionally, any hidden form parameters. The
name of the controls item must match the name attribute of the
corresponding input tag of the form. For example, if the form has the
following HTML tag for entering the username:
the forms item must include a controls item with the name
Bugzilla_login. The controls item used for entering the user's password
must have the secure option set to true. The value of a control item
should usually be the name of a session variable, starting with the
percent (%) sign and enclosed in curly braces ({}); for example, the
value for the username control item:
%{session.sso.token.last.username}. The value can also be a string, or
a combination of strings and session variable names.
EXAMPLES
create form-basedv2 fbssov2-owa2010 { forms add { owa2010 { controls
add { password { secure true value %\{session.sso.token.last.password\}
} username { value %\{session.sso.token.last.username\} } } request-
value /owa/auth/logon.aspx\?replaceCurrent=1 submit-javascript clkLgn()
submit-javascript-type extra success-match-type cookie success-match-
value sessionid } } }
Creates an SSO form-basedv2 configuration object named fbssov2-owa2010.
delete fbsso-owa2010
Deletes an SSO form-basedv2 configuration object named fbssov2-owa2010.
OPTIONS
app-service
Specifies the name of the application service to which the object
belongs. The default value is none. Note: If the strict-updates
option is enabled on the application service that owns the object,
you cannot modify or delete the object. Only the application
service can modify or delete the object.
forms
Specifies one or more items, each defining SSO processing of a
separate application logon form.
[name]
Specifies the name of the form item. It does not have to match the
actual name of the HTML form and can be arbitrary.
The options are:
app-service
Specifies the name of the application service to which the
form item belongs. The default value is none. Note: If the
strict-updates option is enabled on the application service
that owns the object, you cannot modify or delete the form
item. Only the application service can modify or delete the
form item.
attribute-value
Specifies the value of the HTML