About ryan.jensen

ryan.jensen · ‎09-18-2014

18/Sep/2014:21:44:45 -0400 INFO Succeeded 18/Sep/2014:21:44:45 -0400 INFO Response data&colon; HTTP/1.1 302 Found 18/Sep/2014:21:44:45 -0400 INFO Cache-Control: no-cache, no-store, must-revalidate 18/Sep/2014:21:44:45 -0400 INFO Pragma: no-cache 18/Sep/2014:21:44:45 -0400 INFO Content-Type: text/html; charset=utf-8 18/Sep/2014:21:44:45 -0400 INFO Expires: -1 18/Sep/2014:21:44:45 -0400 INFO Location: /PasswordVault/auth/ldap 18/Sep/2014:21:44:45 -0400 INFO Server: Microsoft-IIS/7.5 18/Sep/2014:21:44:45 -0400 INFO X-Frame-Options: SAMEORIGIN 18/Sep/2014:21:44:45 -0400 INFO Set-Cookie: CA22222=; path=/PasswordVault/; HttpOnly 18/Sep/2014:21:44:45 -0400 INFO Set-Cookie: CA11111=; path=/PasswordVault/; HttpOnly 18/Sep/2014:21:44:45 -0400 INFO Set-Cookie: CA33333=; path=/PasswordVault/; HttpOnly 18/Sep/2014:21:44:45 -0400 INFO Set-Cookie: mobileState=Desktop; path=/PasswordVault/; HttpOnly 18/Sep/2014:21:44:45 -0400 INFO Set-Cookie: ASP.NET_SessionId=a041mi45nipato555fxh2f45; path=/; HttpOnly 18/Sep/2014:21:44:45 -0400 INFO X-UA-Compatible: IE=EmulateIE8 18/Sep/2014:21:44:45 -0400 INFO Date: Fri, 19 Sep 2014 01:44:45 GMT 18/Sep/2014:21:44:45 -0400 INFO Connection: close 18/Sep/2014:21:44:45 -0400 INFO Content-Length: 147 18/Sep/2014:21:44:45 -0400 INFO 18/Sep/2014:21:44:45 -0400 INFO 18/Sep/2014:21:44:45 -0400 INFO Object moved to here . 18/Sep/2014:21:44:45 -0400 INFO </body></html> 18/Sep/2014:21:44:45 -0400 INFO Writing request 18/Sep/2014:21:44:45 -0400 INFO Writing request 18/Sep/2014:21:44:45 -0400 INFO Connecting

ryan.jensen · ‎09-16-2014

Hi! It doesn’t require a specific header as far as I know, but I did put the hostname (the same as on the SSL Cert) into the hostname field.

ryan.jensen · ‎09-12-2014

Hello, Thanks for the reply… I did this and here’s what I got: curl -k https:// . /PasswordVault/logon.aspx?ReturnUrl=%2fPasswordVault%2fdefault.aspx Object moved to here . [email protected]:~# curl -k https:// . /PasswordVault/auth/ldap h1. Object Moved This document may be found [here | https:// . /PasswordVault/auth/ldap/]

ryan.jensen · ‎09-11-2014

Hello! I'm trying to setup an http monitor to monitor our Cyberark servers. The URL is https:// <servername>.<domain>/PasswordVault/login.aspx When I go to the URL in my browser, I get redirected to: /PasswordVault/logon.aspx?ReturnUrl=%2fPasswordVault%2fdefault.aspx If I go to https:// <servername>.<domain>/PasswordVault/default.aspx in my browser I get redirected to the same above URL In my Monitor, I put the /PasswordVault/logon.aspx?ReturnUrl=%2fPasswordVault%2fdefault.aspx in the path, thinking I'd avoid any redirects and get an actual 200 OK return code. Not the case. According to STM, it's receiving a 302 no matter what URL I go to. I've done a trace on my local machine with Fiddler and Chrome's built in dev tools and my PC is seeing HTTP 200 OK messages. The reason this is an issue is because last night, the primary server went down, the APP wasn't loading the login page, but for somereasoon STM was still seeing a 302, i'm assuming that's from IIS on the server. Anyone experienced anything similar with HTTP monitors and how did you get around it? I'm running STM 9.6r1.

ryan.jensen · ‎02-27-2014

Hi Bjarke, I didn't think it'd be such an undertaking either.... The VS is setup just like yours. It's HTTP on port 443, I enabled SSL decryption and pointed to my wildcard cert for the site. In theory it should be an easy setup, but of course, with my luck it's not working. I've had similar woes with Sharepoint, but maybe I'll try your traffic script example and see if it does anything for me.

ryan.jensen · ‎02-26-2014

Hi Stefano, I did as you suggested. I created a request rule with just the suggested command. I also modified string.replaceAll to string.replaceAllI. I'm getting the same results. Authentication still fails. I've looked at my source of the page and every URL listed in the page is https:// , not http:// . How do I check the response / request headers? Unfortunately, I'm not a web guy, so this is not my strong-point. Would you have any other ideas? Thanks!

ryan.jensen · ‎02-25-2014

Hello, I'm trying to get SSL Offloading to work with an new web-app we're bringing online. It's meant to run over http between client and server. If i configure STM Virtual server as port 80, it works fine. Main page displays, user can enter credentials to login or hit the "Use Windows Credentials" button. I'm trying to get this to work properly with SSL Offloading. When i enable SSL Offloading, I have to use an HTTP response rule to re-write the returned content to call all https URLs. I use this rule for that: #$url = http.getResponseHeader( "Content-Type" ); #if( !string.startsWith( $url, "text/html" ) ) break; $response = http.getResponseBody ( ) ; $response = string.replaceAll ( $response , " http://server.domain.org/ " , " https://server.domain.org/ " ) ; http.setResponseBody ( $response ) ; Yes, I have the sanity check commented out. The main login page calls some .ashx files that dont have the content type in them so they aren't re-written. Even more stuff breaks then. The problem I'm seeing is that even though I get the login page to load over SSL now, there are no mixed-content security issues or cert issues, I cannot login. My credentials no longer work to access the app. I cannot manually enter credentials nor does the "Use Windows Credentials" work. Of note, when I use windows credentials via HTTPS, i see my machine doing a kerberose authentication to AD. When over HTTP, I do not see this same transaction. It would appear i'm athenticating to AD properly, because I can do it repeatedly and my AD account will not lock out. Has anyone dealt with anything similar and gotten it to work? Thanks in advance.

Re: SteelApp HTTP Monitor and 302 vs 200 OK

Re: SteelApp HTTP Monitor and 302 vs 200 OK

Re: SteelApp HTTP Monitor and 302 vs 200 OK

SteelApp HTTP Monitor and 302 vs 200 OK

Re: SSL Offload breaks Authentication

Re: SSL Offload breaks Authentication

SSL Offload breaks Authentication