Install Profile Filter for F5 Endpoint Gating

Explains how the Install Profile Filter gates access to F5-specific API endpoints based on the system's installation profile. Details the mechanism and

Overview

The InstallProfileFilter is a security component that acts as a gate for incoming API requests. Its primary function is to conditionally block access to a specific set of F5-related API endpoints based on the system's current installation profile.

This filter solves the problem of exposing specialized features that are only relevant for certain deployment types. When the platform is installed with a profile that does not include F5 integration (such as generic_soap_to_rest), this filter prevents API consumers from accessing F5-specific endpoints, ensuring a clean and secure API surface.

The InstallProfileFilter operates within the request processing chain of the Admin API. It is designed to execute before the main AdminAuthorizationFilter, which handles role-based access control. This means a request to a gated endpoint will be rejected by this filter even if the caller has the necessary roles, as the feature itself is considered disabled at the platform level.

How it works

The InstallProfileFilter intercepts every request made to the platform. Its logic follows a precise sequence to determine whether to block the request or allow it to proceed.

flowchart TD
    subgraph "API Platform"
        direction LR
        A[HTTP Request] --> B(InstallProfileFilter);
        B --> C{Is path F5-specific?};
        C -- No --> G(Continue to next filter);
        C -- Yes --> D{Is F5 profile active?};
        D -- Yes --> G;
        D -- No --> E[Respond 403 Forbidden];
        E --> F(Request terminated);
    end
    Consumer([API Consumer]) -.-> A

The processing flow is as follows:

An HTTP request is received by the platform.
The InstallProfileFilter intercepts the request. It is configured with a high precedence (@Order(Ordered.LOWEST_PRECEDENCE - 100)) to ensure it runs before other authorization filters.
The filter securely resolves the request's routed path. It uses the path that the Spring framework routes on, which prevents bypass attempts using URL encoding or path parameters (e.g., /admin/v1;x=1/f5/...). An unresolvable path is treated as a potential F5 path and is blocked by default ("fail-closed").
The filter checks if the resolved path starts with one of the predefined F5-specific prefixes.
If the path matches an F5 prefix, the filter then checks if F5 features are enabled for the current installation by querying the InstallProfileRepository.
Blocked Request: If the path is F5-specific and the installation profile has F5 features disabled, the filter immediately stops processing. It:
- Sets the HTTP response status to 403 Forbidden.
- Sets the Content-Type header to application/json.
- Writes a specific JSON error object to the response body.
- Terminates the request, preventing it from reaching any other filters or the target endpoint.
Allowed Request: If the path is not F5-specific, or if F5 features are enabled, the filter passes the request along to the next component in the filter chain for further processing, such as role-based authorization.

Gated API Endpoints

The InstallProfileFilter blocks requests to any path that begins with the following prefixes when the F5 feature set is disabled by the installation profile:

/admin/v1/f5/
/admin/v1/master-discovery/
/admin/v1/settings/f5/
/ingest/v1/f5/

IMPORTANT

Any request whose path cannot be resolved by the routing system is treated as a gated path and will be blocked if F5 features are disabled. This is a security measure to ensure the filter fails closed.

Error Response

When a request is blocked by the InstallProfileFilter, the API responds with an HTTP 403 Forbidden status code. The response body contains a JSON object with a specific error code and message, providing clear feedback to the API consumer.

Example Blocked Request Response

The following payload is returned when a consumer attempts to access an F5-specific endpoint on a system with a non-F5 installation profile, such as generic_soap_to_rest.

{
  "error": {
    "code": "S2R-ADM-0F5",
    "message": "F5 features disabled by install profile",
    "details": {
      "installProfile": "generic_soap_to_rest"
    }
  }
}

The installProfile field in the details object will reflect the actual, current installation profile of the system.

Troubleshooting

403 Forbidden with code S2R-ADM-0F5

Condition: An API request to an endpoint (e.g., /admin/v1/f5/status) fails with an HTTP 403 Forbidden status and the error code S2R-ADM-0F5.
Cause: This error indicates that the target endpoint is part of the F5 feature set, but the platform has been installed with a profile that disables these features.
Resolution: This is expected behavior. The API consumer should not call F5-specific endpoints on a system where they are not enabled. The feature is unavailable for the current deployment type.