APM 2FA with SSO

before the SSO credential mapping but after the authentication, you'll need an iRule (agent) to strip the last X characters of your password variable. If I remember well, there's no tcl function to strip the last X characters, so you'll need to use other (than trimright) string functions to find the length of string and then find the string with index Len-X. In codeshare you'll find examples.

Why don't you have 2 fields, one more otp and another for AD(?) and then reassign the variables as explained here?

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-0/6.html

thanks amolari, sounds like the irules is not going to be simple.

kunjan, i have tried 2 fields and reassigning the variables but apm is not taking my custom variables. let me take a look at the link you send. let's see if i can get it to work.

Thanks :)

this is what i tried. but seems like it is not working.

in my logon page, i have 2 fields. password field with variable call pass DS3 token field with variable call pass1

the VPE flow is as per start -> logon -> variable assignment -> radius auth -> resource assign i skip AD authentication for now since we are focusing on getting the 2FA with SSO working.

my variable assignment configuration is as below. session.logon.last.password = expr { "[mcget {session.logon.last.pass}][mcget {session.logon.last.pass1}]" }

however, it seems like i am not able to combine the 2 variable. anyone have any idea why????

Try this session.logon.last.password = return { "[mcget {session.logon.last.pass}][mcget {session.logon.last.pass1}]" }

May be I missed something. Why need to combine the passwords?

Typically RSA authentication is done first('password' hold RSA pin) and the after RSA auth reassign the 'password1' variable(holding AD password) to the standard variable 'password', before the AD auth.

So the key is before AAA auth, populate the session.logon.last.username and session.logon.last.password with the corresponding values.

hi kunjan,

i am using radius for the 2FA. and the issue here is because when i do the password for the following syntax

password+otp which is the format that is taken by the 2FA. i couldn't get SSO to work.

thanks mark for the variable expression. will test it out and revert.

the variable is no good. i am able to capture both variables now but unable to combine them lolz.