apm sso form-basedv2ΒΆ
apm sso form-basedv2(1) BIG-IP TMSH Manual apm sso form-basedv2(1)
NAME
form-basedv2 - Configures a single sign-on form-basedv2 configuration object.
MODULE
apm sso
SYNTAX
Configure the form-basedv2 component within the sso module using the syntax shown in the following sections.
CREATE/MODIFY
create form-basedv2 [name]
options:
app-service [[string] | none]
forms [add | replace-all-with] {
[name] {
request-value [URIs]
controls [add | replace-all-with] {
[name] {
value [string]
}
}
}
}
modify form-basedv2 [name]
options:
apm-log-config [[string] | none]
app-service [[string] | none]
forms [add | delete | modify | replace-all-with] {
[name] {
options:
app-service [[string] | none]
attribute-value [[string] | none]
controls [add | delete | modify | replace-all-with] {
[name] {
options:
app-service [[string] | none]
secure [true | false]
value [string]
}
}
description [[string] | none]
form-order [integer]
id-type [action | id | inputs | name | order]
request-method [get | post]
request-name [[string] | none]
request-negative [true | false]
request-prefix [true | false]
request-type [cookie | header | uri]
request-value [[string] | none]
submit-autodetect [true | false]
submit-javascript [[string] | none]
submit-javascript-type [auto | custom | extra]
submit-method post
submit-name [[string] | none]
submit-negative [true | false]
submit-prefix [true | false]
submit-type [cookie | header | uri]
submit-value [[string] | none]
success-match-type [cookie | none | url]
success-match-value [[string] | none]
}
}
headers [add | delete | modify | none | replace-all-with] {
[name] {
options:
app-service [[string] | none]
description [[string] | none]
name [string]
value [string]
}
}
log-level [alert | crit | debug | emerg | err | info | notice | warn]
edit form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
reset-stats
reset-stats [ [ [name] | [glob] | [regex] ] ... ]
DISPLAY
list form-basedv2
list form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
show running-config form-basedv2
show running-config form-basedv2 [ [ [name] | [glob] |
[regex] ] ... ]
options:
all-properties
non-default-properties
one-line
partition
show form-basedv2
show form-basedv2 [name]
DELETE
delete form-basedv2 [name]
DESCRIPTION
You can use the form-basedv2 component to configure an SSO form-basedv2 configuration object. When creating a
new SSO form-based v2 configuration object, you must add at least one forms item and within it at least one
controls item. You must also provide a value for the request-value option in the forms item.
The SSOv2 module identifies and processes two types of application HTTP requests - logon page requests and
credentials submit requests. Logon page requests are identified using the request- set of options. Credentials
submit requests, in most cases, are identified automatically. When this fails, you can set the submit-
autodetect option to false and use the submit- set of options to identify these requests.
When the SSOv2 module identifies a logon page request, it scans the response trying to find the logon form. If
the logon form is found, SSOv2 inserts a JavaScript code that will cause the logon form to be submitted
automatically by the browser. The client must support JavaScript.
When the SSOv2 module identifies a credentials submit request, it compares POST data parameter names with form
controls defined in the configuration. For a POST data parameter name that has a corresponding form control,
the SSOv2 module replaces its value with the control value from the configuration. Control values are usually
supplied through session variables, such as session.sso.token.last.username and
session.sso.token.last.password. POST data parameters that have no corresponding controls in the configuration
are not changed.
The majority of web applications have a single logon page with one logon form. You will need to define a
single forms item for these applications. In rare cases when an application has multiple logon pages with
different logon forms, you will need to create multiple forms items, one for each logon page/form. If multiple
logon pages use the same form, you will need only one forms item with a list of URIs for all logon pages.
Every forms item must include at least one controls item, and can include up to 32 controls items. Each
controls item represents an input element of an HTML logon form, such as form fields for entering username and
password, and, optionally, any hidden form parameters. The name of the controls item must match the name
attribute of the corresponding input tag of the form. For example, if the form has the following HTML tag for
entering the username:
the forms item must include a controls item with the name Bugzilla_login. The controls item used for entering
the user's password must have the secure option set to true. The value of a control item should usually be the
name of a session variable, starting with the percent (%) sign and enclosed in curly braces ({}); for example,
the value for the username control item: %{session.sso.token.last.username}. The value can also be a string,
or a combination of strings and session variable names.
EXAMPLES
create form-basedv2 fbssov2-owa2010 { forms add { owa2010 { controls add { password { secure true value
%\{session.sso.token.last.password\} } username { value %\{session.sso.token.last.username\} } } request-
value /owa/auth/logon.aspx\?replaceCurrent=1 submit-javascript clkLgn() submit-javascript-type extra success-
match-type cookie success-match-value sessionid } } }
Creates an SSO form-basedv2 configuration object named fbssov2-owa2010.
delete fbsso-owa2010
Deletes an SSO form-basedv2 configuration object named fbssov2-owa2010.
OPTIONS
app-service
Specifies the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
forms
Specifies one or more items, each defining SSO processing of a separate application logon form.
[name]
Specifies the name of the form item. It does not have to match the actual name of the HTML form and can
be arbitrary.
The options are:
app-service
Specifies the name of the application service to which the form item belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the form item. Only the application service can modify or delete the
form item.
attribute-value
Specifies the value of the HTML