Lab 1.8 - Implement Dynamic Certificate Injection

In this section, we will use the HTTP Connector to retrieve a user’s certificate from Active Directory and use it in the BIG-IP Certificate minting process.

Task - Create an HTTP Connector Transport

1. Navigate to Access >> Authentication >> HTTP Connector >> HTTP Connector Transport and click the + (plus symbol)

   

2. Enter Name demo-http-connector

3. Select prebuilt-dns-resolver from the DNS Resolver dropdown

4. Select prebuilt-adpiadmin-serverssl from the Server SSL Profile

5. Click Save

   

Task - Create a HTTP Connector Request

1. Navigate to Access >> Authentication >> HTTP Connector >> HTTP Connector Request and click the + (plus symbol)

   

2. Enter name get-cert

3. Select demo-http-connector from the dropdown

4. Enter URL https://adapi.f5lab.local:8443/aduser/cert?useridentity=%{perflow.username}

5. Enter GET for the Method

6. Select Parse for the Response Action

7. Click Save

   

Task - Create a Per-Request Policy

1. Navigate to Access >> Profiles/Policies >> Per-Request Policies and click the + (plus symbol)

   

2. Enter the name certsso_prp

3. Select the Language English

4. Click Finished

   

5. Click edit under Per-Request Policy

   

6. Click Add New Subroutine

   

7. Enter the name Request Cert

8. Click Save

   

9. Expand the subroutine by click the + (plus symbol)

   

10. Click the + (plus symbol) on the fallback branch.

    

11. Click the General Purpose tab

12. Select HTTP Connector

13. Click Add Item

    

14. Select get-cert drop the dropdown

    

15. Click Edit Terminals

    

16. Click Add Terminal

    

17. Change the name for the default branch to Fail

18. Change the default branch text to Red

19. Enter the name Success for the new branch

20. Change the color of the new branch to Success

    

21. Click the Fail terminal at the end of the Successful branch

    

22. Select the Success terminal

23. Click Save

    

24. Click the + (plus symbol) on the successful branch

    

25. Click the Assignment tab

26. Select Variable Assign

27. Click Add Item

    

28. Click Add new entry

29. Click change

    

30. Enter session.ssl.cert.whole for the Custom Variable

31. Select Session Variable from the dropdown

32. Enter subsession.http_connector.body.certificate for the Session Variable

33. Click Finished

    

34. Click Save

    

35. Click the + (plus symbol) located between Start and Allow in the policy

    

36. Click the Subroutines tab

37. Select the Request Cert subroutine

38. Click Add Item

    

39. Click the + (plus symbol) on the success branch of Request Cert

    

40. Click the General Purpose tab

41. Select irule Event

42. Click Add Item

Note

This iRule event triggers the code from the previously attached iRule. This iRule must be used when inserting a certificate using C3D in a per-request policy.

when ACCESS_PER_REQUEST_AGENT_EVENT {
   set cert [ACCESS::session data get {session.ssl.cert.whole}]
   log local0. "My cert: $cert"
   SSL::c3d cert [X509::pem2der $cert]
}

43. Enter lab for the ID
44. Click Save

Task - Attach the PRP to the mTLS Virtual Server

1. Navigate to Local Traffic >> Virtual Servers. Click Virtual Server List

2. Click mtls_vs

3. Navigate to the Access Policy section and select certsso_prp from the Per-Request Policy dropdown
4. Click Update