Ctrl K

Apply access policy

Published today

Apply the access policy of an APM access profile (UI "Apply Access Policy"). Access profile is the profile name, or its full path such as /Common/my_ap or /Common/app.app/app_ap for iApp or Guided Configuration deployments.

Script f5_bigip Verified

Use in Windmill

The script

Submitted by hugo989 Typescript (fetch-only)

Verified 6 hours ago

All edits

Permalink

//native

async function connect(auth: RT.F5Bigip): Promise<{
  base: string
  headers: { [key: string]: string }
  release: () => Promise<void>
}> {
  const base = auth.base_url.replace(/\/+$/, "")
  if (auth.auth_method === "basic") {
    return {
      base,
      headers: {
        Authorization: `Basic ${btoa(`${auth.username}:${auth.password}`)}`,
      },
      release: async () => {},
    }
  }
  const login = await fetch(`${base}/mgmt/shared/authn/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json", Accept: "application/json" },
    body: JSON.stringify({
      username: auth.username,
      password: auth.password,
      loginProviderName: auth.login_provider_name || "tmos",
    }),
  })
  if (!login.ok) {
    throw new Error(`${login.status} ${await login.text()}`)
  }
  const token: string = (await login.json()).token.token
  return {
    base,
    headers: { "X-F5-Auth-Token": token },
    release: async () => {
      await fetch(
        `${base}/mgmt/shared/authz/tokens/${encodeURIComponent(token)}`,
        {
          method: "DELETE",
          headers: { "X-F5-Auth-Token": token },
        }
      )
    },
  }
}

// "/Common/web" or "web" + partition -> "~Common~web" (iControl REST object reference);
// "%" (route domains, e.g. 10.0.0.1%2:80), "?" and "#" are escaped
function ref(name: string, partition: string | undefined) {
  const path = name.startsWith("/") ? name : `/${partition || "Common"}/${name}`
  return path.replace(/\//g, "~").replace(/[%?#]/g, encodeURIComponent)
}

/**
 * Apply access policy
 * Apply the access policy of an APM access profile (the "Apply Access Policy" action of the BIG-IP UI), by incrementing the profile's generation. New sessions use the updated policy.
 */
export async function main(
  auth: RT.F5Bigip,
  access_profile: string,
  partition: string | undefined
) {
  const f5 = await connect(auth)
  try {
    const response = await fetch(
      `${f5.base}/mgmt/tm/apm/profile/access/${ref(access_profile, partition)}`,
      {
        method: "PATCH",
        headers: {
          ...f5.headers,
          "Content-Type": "application/json",
          Accept: "application/json",
        },
        body: JSON.stringify({ generationAction: "increment" }),
      }
    )

    if (!response.ok) {
      throw new Error(`${response.status} ${await response.text()}`)
    }

    return await response.json()
  } finally {
    await f5.release()
  }
}


`1`	`//native`
`2`
`3`	`async function connect(auth: RT.F5Bigip): Promise<{`
`4`	`base: string`
`5`	`headers: { [key: string]: string }`
`6`	`release: () => Promise<void>`
`7`	`}> {`
`8`	`const base = auth.base_url.replace(/\/+$/, "")`
`9`	`if (auth.auth_method === "basic") {`
`10`	`return {`
`11`	`base,`
`12`	`headers: {`
`13`	Authorization: `Basic ${btoa(`${auth.username}:${auth.password}`)}`,
`14`	`},`
`15`	`release: async () => {},`
`16`	`}`
`17`	`}`
`18`	const login = await fetch(`${base}/mgmt/shared/authn/login`, {
`19`	`method: "POST",`
`20`	`headers: { "Content-Type": "application/json", Accept: "application/json" },`
`21`	`body: JSON.stringify({`
`22`	`username: auth.username,`
`23`	`password: auth.password,`
`24`	`loginProviderName: auth.login_provider_name \|\| "tmos",`
`25`	`}),`
`26`	`})`
`27`	`if (!login.ok) {`
`28`	throw new Error(`${login.status} ${await login.text()}`)
`29`	`}`
`30`	`const token: string = (await login.json()).token.token`
`31`	`return {`
`32`	`base,`
`33`	`headers: { "X-F5-Auth-Token": token },`
`34`	`release: async () => {`
`35`	`await fetch(`
`36`	`${base}/mgmt/shared/authz/tokens/${encodeURIComponent(token)}`,
`37`	`{`
`38`	`method: "DELETE",`
`39`	`headers: { "X-F5-Auth-Token": token },`
`40`	`}`
`41`	`)`
`42`	`},`
`43`	`}`
`44`	`}`
`45`
`46`	`// "/Common/web" or "web" + partition -> "~Common~web" (iControl REST object reference);`
`47`	`// "%" (route domains, e.g. 10.0.0.1%2:80), "?" and "#" are escaped`
`48`	`function ref(name: string, partition: string \| undefined) {`
`49`	const path = name.startsWith("/") ? name : `/${partition \|\| "Common"}/${name}`
`50`	`return path.replace(/\//g, "~").replace(/[%?#]/g, encodeURIComponent)`
`51`	`}`
`52`
`53`	`/**`
`54`	`* Apply access policy`
`55`	`* Apply the access policy of an APM access profile (the "Apply Access Policy" action of the BIG-IP UI), by incrementing the profile's generation. New sessions use the updated policy.`
`56`	`*/`
`57`	`export async function main(`
`58`	`auth: RT.F5Bigip,`
`59`	`access_profile: string,`
`60`	`partition: string \| undefined`
`61`	`) {`
`62`	`const f5 = await connect(auth)`
`63`	`try {`
`64`	`const response = await fetch(`
`65`	`${f5.base}/mgmt/tm/apm/profile/access/${ref(access_profile, partition)}`,
`66`	`{`
`67`	`method: "PATCH",`
`68`	`headers: {`
`69`	`...f5.headers,`
`70`	`"Content-Type": "application/json",`
`71`	`Accept: "application/json",`
`72`	`},`
`73`	`body: JSON.stringify({ generationAction: "increment" }),`
`74`	`}`
`75`	`)`
`76`
`77`	`if (!response.ok) {`
`78`	throw new Error(`${response.status} ${await response.text()}`)
`79`	`}`
`80`
`81`	`return await response.json()`
`82`	`} finally {`
`83`	`await f5.release()`
`84`	`}`
`85`	`}`
`86`