Cisco PIX 500 Series Configuration Manual page 772

Getting Started
Start your browser and HTTP header analyzer, and connect directly to the web server login page without
Step 1
going through the security appliance.
After the web server login page has loaded in your browser, examine the login sequence to determine if
Step 2
a cookie is being set during the exchange. If the web server has loaded a cookie with the login page,
configure this login page URL as the start-URL.
Enter the username and password to log in to the web server, and press Enter. This action generates the
Step 3
authentication POST request that you examine using the HTTP header analyzer.
An example POST request—with host HTTP header and body—follows:
POST
/emco/myemco/authc/forms/MCOlogin.fcc?TYPE=33554433&REALMOID=06-000430e1-7443-125c-ac05-83
846dc90034&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$5FZmjnk3DRNwNjk2KcqVCFbIrNT9%2b
J0H0KPshFtg6rB1UV2PxkHqLw%3d%3d&TARGET=https%3A%2F%2Fwww.example.com%2Femco%2Fmyemco%2F
HTTP/1.1
Host: www.example.com
(BODY)
SMENC=ISO-8859-1&SMLOCALE=US-EN&USERID=Anyuser&USER_PASSWORD=XXXXXX&target=https%3A%2F%2Fw
ww.example.com%2Femco%2Fmyemco%2F&smauthreason=0
Examine the POST request and copy the protocol, host, and the complete URL to configure the action-uri
Step 4
parameter.
Examine the POST request body and copy the following:
Step 5
a. Username parameter. In the preceding example, this parameter is USERID, not the value anyuser.
b. Password parameter. In the preceding example, this parameter is USER_PASSWORD.
Hidden parameter. This parameter is everything in the POST body except the username and
c.
password parameters. In the preceding example, the hidden parameter is:
SMENC=ISO-8859-1&SMLOCALE=US-EN&target=https%3A%2F%2Fwww.example.com%2Fe
mco%2Fmyemco%2F&smauthreason=0
Figure 37-3
from an HTTP analyzer. This is only an example; output varies widely across different websites.
Cisco Security Appliance Command Line Configuration Guide
37-16
highlights the action URI, hidden, username and password parameters within sample output
Chapter 37 Configuring Clientless SSL VPN
OL-12172-03