Forum Discussion

JWhitesPro_1928's avatar
JWhitesPro_1928
Icon for Cirrostratus rankCirrostratus
Apr 13, 2015

APM - Log user into backend webpage as a different account

I thought I saw an example of this on the forums but I can't 'seem to find it. Does anyone have any direction for this scenario:

 

-Want to log a user into APM as a user from domain A. -If they auth successfully (and pass a group membership check) -Forward them to the backend pool but log them into that backend webserver as an account from Domain B (a generic service account for instance). -The service account they would be logged in as would be determined by their group membership in domain A.

 

The backend server would be windows integrated authentication.

 

1 Reply

  • Arnaud_Lemaire's avatar
    Arnaud_Lemaire
    Icon for Employee rankEmployee
    Apr 16, 2015

    Hi,

     

    if kerberos is an option to the backend, you coulddo kerberos constraint delegation with a kerberos sso profile to your app.

     

    In you VPE after the pre authentication and group membership validation you assign variables session.sso.token.last.username and session.logon.last.domain according to group membership.