Custom App ID - Derived from usernames/http params

[SDorsey]

I am working with a client in an interesting situation..

We are basically needing to limit sections of the network where certain users and login to a web server. For example, only admins can login from zone1 and only users can login from zone2. The application on the web server is not a custom one built by the client but there is no current ID for it in the app-id db.

Currently, we would like to make the policy decisions based on app.. and have a separate ID based on admins or users.

I created an APP-ID for the application itself and tested it; it works! I also checked "Continue scanning for other applications".

Next, I used a proxy to monitor the packets and found that the username is submitted via HTTP PARAMS. So, I cloned the original APP-ID and made a new one (we will call it App-User). I added an AND condition to the original signature and it looks for:

Context: http-req-params

pattern: user (I have also tried username=user).

Qualifier is http method = POST.

After committing this.. the PAN IDs the traffic as the original APP-ID but does NOT change the app identified once someone sends posts requests with the specific username identified.

Will this not work in the manner I think it would? Any better suggestions?

FWIW: I don't have to create an AND rule for each user. The user base all share a generic ID for this system.

[ukhapre]

You may want to put the question in Dev community for faster response.

[GLastra]

In the pattern you should put the pattern that you see in the packet capture, remember that must be bigger than 7 characters. But the app-user only is going to be detected when you try to log in, if you block the app you just block the login to the user definided in your app. Also you can try putting the rule above that the rule that accept the App-ID, creating custom signatures sometimes can be a headache.

Regards,