For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Roman_178798's avatar
Roman_178798
Icon for Nimbostratus rankNimbostratus
Apr 11, 2016

APM is not forwarding authentication token to ADFS

Hello experts,   we configured ADFS on F5, in deployment guide, the name is Securing AD FS with the BIG-IP APM. Customer had another demmand, to authenticat with UPN only, not with SAMACCOUNTNAME....
application delivery
BIG-IP
BIG-IP Access Policy Manager (APM)
Josiah_39459's avatar
Josiah_39459
Historic F5 Account
Apr 11, 2016

Since the LDAP auth applies only to the Access Policy, it has no bearing on the backend server. It sounds to me like your problem is likely in the SSO.

 

You didn't say what type of SSO you are using, but if it is expecting the samaccountname and you are sending the UPN and they are different, it's obviously going to fail, right?

 

  • BigFoot's avatar
    BigFoot
    Icon for Nimbostratus rankNimbostratus
    Apr 11, 2016
    Yes, I am using NTLMv1, sorry forgot to add here. and setting is default.Just domain is different. According to application team, they cannot see any authentication attemp on ADFS
  • Josiah_39459's avatar
    Josiah_39459
    Historic F5 Account
    Apr 11, 2016
    Well, a packet capture and websso logs (potentially debug) will tell you for sure. NTLM's just a http header. But it seems as a bare minimum you have to fix your SSO credential assign to be valid.
  • BigFoot's avatar
    BigFoot
    Icon for Nimbostratus rankNimbostratus
    Apr 21, 2016
    It takes some time, but I did packet capture, decrypt traffic, but it seems that user's credentials are not added to the NTLM header, so they are not passed to ADFS. Does anybody know please, how the correct setup should looks like for ADFS with authentication based on UPN and not SamAccountName?