2.2. Deploy User Coaching Objects

2.2.1. User Coaching Script

User coaching functionality is a Service Extension for SSL Orchestrator. An installation script automates the creation of the configuration objects needed to implement this functionality.

  • The script creates the following objects:

    • F5_UC Inspection Service - the user coaching Service Extension to interact with decrypted traffic flows.

    • Internal Virtual Service to act as the target for the User Coaching Service.

    • User coaching iRule - injects the user blocking and coaching prompts, as well as optional logging.

    • TLS fingerprinting iRule - determines if a user has already completed the user coaching flow.

    • user-coaching-html iFile - contains the user coaching HTML template.

    • user-blocking-html iFile - contains the user blocking HTML template.


2.2.2. Quick Prerequisite check

After your lab is spun up, we need to ensure the SSL Orchestrator Module is ready to configure.


  1. From the UDF Deployment tab, access the TMUI of the BIG-IP SSL Orchestrator resource and login as the admin user with the password admin.

    ../../_images/udf-sslo-tmui2.png

  2. Click on SSL Orchestrator and check the top right icons. If there is a red icon in the top right, click it and follow the prompts to fully initialize the module.

    ../../_images/initialize_sslo.png

2.2.3. Download the Installation Script

  1. From the UDF Deployment tab, access the Web Shell of the BIG-IP SSL Orchestrator resource. This will open a new browser tab with an SSH session (logged in as the root user).

    ../../_images/udf-sslo-webshell-11.png

  2. Change Directory to the /tmp directory:

    cd /tmp

  3. Download the installation script:

    curl -sk https://raw.githubusercontent.com/f5devcentral/sslo-service-extensions/refs/heads/main/user-coaching/user-coaching-installer.sh -o user-coaching-installer.sh

    Tip

    Click the copy icon in the URL text box above and paste it into the BIG-IP SSL Orchestrator - Web Shell session. If your local machine is Windows, press the <CTRL>-<SHIFT>-V combination to paste.

2.2.4. Run the Installation Script

  1. Make the installation script executable:

    chmod +x user-coaching-installer.sh

  2. Create a BASH environment variable containing the BIG-IP username and password:

    export BIGUSER='admin:admin'

  3. Run the installation script to create all of the User Coaching objects:

    ./user-coaching-installer.sh
    ../../_images/udf-sslo-webshell-21.png

2.2.5. Verify Object Creation

  1. From the UDF Deployment tab, access the TMUI of the BIG-IP SSL Orchestrator resource. This will open a new browser tab with a GUI session (login as the admin user with the password admin).

    ../../_images/udf-sslo-tmui2.png

  2. Navigate to Local Traffic > iRules and verify that the following iRules are present.

    • user-coaching-ja4t-rule

    • user-coaching-rule

    ../../_images/uc-install-verify-1-a.png

  3. Click on the iFile List tab and verify that the user-coaching-html and user-blocking-html iFiles are present.

    ../../_images/uc-install-verify-2-a.png

  4. Navigate to SSL Orchestrator > Configuration. In the diagram, you should see the ssloS_F5_UC Inspection Service icon.

  5. Click on the Services tab and verify that the ssloS_F5_UC Inspection Service is present.

    ../../_images/uc-install-verify-31.png

This completes the installation of the configuration objects needed to support the user coaching function. In a later step, you will add the resulting ssloS_F5_UC inspection Service to a decrypted traffic Service Chain and add the user-coaching-ja4t-rule iRule to the L3 Outbound Topology's Interception Rule.