3.2. Deploy User Coaching Objects

3.2.1. User Coaching Script

User coaching functionality is a Service Extension for SSL Orchestrator. An installation script automates the creation of the configuration objects needed to implement this functionality.

The script creates the following objects:

  • F5_UC Inspection Service - the user coaching Service Extension to interact with decrypted traffic flows.

  • User coaching iRule - injects the user blocking and coaching prompts, as well as optional logging.

  • TLS fingerprinting iRule - determines if a user has already completed the user coaching flow.

  • user-coaching-html iFile - contains the user coaching HTML template.

  • user-blocking-html iFile - contains the user blocking HTML template

3.2.2. Download the Installation Script

  1. From the UDF Deployment tab, access the Web Shell of the BIG-IP SSL Orchestrator resource. This will open a new browser tab with an SSH session (logged in as the root user).

    ../../_images/udf-sslo-webshell-1.png

  2. Download the installation script:

    cd /tmp

curl -sk https://raw.githubusercontent.com/f5devcentral/sslo-service-extensions/refs/heads/main/user-coaching/user-coaching-installer.sh -o user-coaching-installer.sh

    Tip

    Click the copy icon in the URL text box above and paste it into the Ubuntu-Client - Web Shell session. If your local machine is Windows, press the <CTRL>-<SHIFT>-V combination to paste.

3.2.3. Run the Installation Script

  1. Make the installation script executable:

    chmod +x user-coaching-installer.sh

  2. Create a BASH environment variable containing the BIG-IP username and password:

    export BIGUSER='admin:admin'

  3. Run the installation script to create all of the User Coaching objects:

    ./user-coaching-installer.sh
    ../../_images/udf-sslo-webshell-2.png

3.2.4. Verify Object Creation

  1. Switch to your local web browser tab that contains the BIG-IP TMUI.

  2. Navigate to Local Traffic > iRules and verify that the following iRules are present.

    • user-coaching-ja4t-rule

    • user-coaching-rule

    ../../_images/uc-install-verify-1.png

  3. Click on the iFile List tab and verify that the user-coaching-html and user-blocking-html iFiles are present.

    ../../_images/uc-install-verify-2.png

  4. Navigate to SSL Orchestrator > Configuration. In the diagram, you should see the ssloS_F5_UC Inspection Service icon (along with the others that you previously deployed).

  5. Click on the Services tab and verify that the ssloS_F5_UC Inspection Service is present.

    ../../_images/uc-install-verify-3.png

This completes the installation of the configuration objects needed to support the user coaching function. In a later step, you will add the resulting ssloS_F5_UC inspection Service to a decrypted traffic Service Chain and add the user-coaching-ja4t-rule iRule to the L3 Outbound Topology's Interception Rule.