Hello There,

I am a beginner in Apache and trying to figure out a way to validate a query string in the request handled by Apache and proxy the request to backend application only upon validation of the query string value.

For Example My current Virtual Host directive in httpd.conf is like this. Please excuse me if this is lengthy. 

==================================================
<Location /fed/idp>
 # Standalone weblogic that contains the custom code
 WebLogicHost <hostname>.<domain>.com
 WebLogicPort 7499
 # If Client Certificate Authentication successful in Apache,
 # redirect to AD Authentication for 2nd Factor
 RewriteEngine On
 RewriteCond %{SSL:SSL_CLIENT_VERIFY} ^SUCCESS$
 # If referenceid is not found in the query string, it means the user 
+is first time user.
 # Send him to custom code for 2nd factor AD AuthN
 RewriteCond %{QUERY_STRING} !referenceid
 # Application deployed in Weblogic for AD AuthN
 RewriteRule .* /authenticator/internal/Processor [L]
==================================================

[download]

In the above piece, I am passing the request to a custom AD Authentication module deployed in my Weblogic if Certificate AuthN succeeds to perform a 2-factor AuthN.

1) For a first time user, upon certificate AuthN success in Apache, his request will not contain a query string named "referenceid" (which is set by my custom AuthN module that gets invoked in #2 below ) and so the user will be directed to AD Authentication module for 2nd factor Authentication.

2) Upon successful AD Authentication, I will set a random "referenceid:value" in the original request URL as query string and redirect back to Apache.

3) Now when Apache receives this access request from #2 above, Cert AuthN will not be invoked as there will be a SSL session maintained. But to identify whether this user access has to be sent to AD AuthN, i currently validate the existence of referenceid in query string.

However, I want to actually validate whether the value of referenceid in the query string matches with what i have set in #2. If successful, I do not want the second factor AuthN to be invoked. The user must be proxied to the backend application directly.

Please help !

In reply to (OT) Query String Validation in Apache by prasee

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.