BigIP APM - AD & RSA auth

Do you want to present a logon page where the user enters user/pass and PIN? If so, try this:

1. In the visual policy editor, start with your logon page and add a third field (we'll call it "token") - of type password.

2. Both AD auth and SecurID agents use the session.logon.last.password session variable, so after the logon page, save the logon page's password to a separate session (temporary) session variable, re-assign session.logon.last.password to be the token value from the logon page, and pass this to the RSA SecurID agent.

   session.logon.temp.password = mcget {session.logon.last.password}
   session.logon.last.password = mcget {session.logon.last.token}
   

3. Out of the successful branch of the SecurID agent, swap the variables so that the user's password is back in the session.logon.last.password session variable, and pass to AD Auth.

   session.logon.last.password = mcget {session.logon.temp.password}
   

This should get you through both auth agents.

Thanks, we do want to present a logon page where the user enters domain username, domain password and secure id pin. I tried adding the variable straight out of the logon page and am getting:

010712163: in variable assignment agent (/common/uris_2_act_variable_assign_Ag) varname (session.login.temp.password) can only have [A-Za z0-9_/-,],

I might be doing this wrong as im totally new to this...!

Your variable assignment just needs to store the user-entered value from the logon page into a temporary session variable, then swap it back after the first auth agent. How do you have it configured now?

think it was my typo or similar, used this and it appears to be going:

session.logon.last.password = expr { [mcget -secure session.logon.last.token] }

thanks very much!

When building the policy within APM is there any preference as to which agent comes first after the login page? My assumption would be SecurID followed by AD but I've seen another post showing the opposite (https://devcentral.f5.com/questions/f5-apm-mutiple-authentication-method)

nope, that is your own choice. as long as your set the variables correctly before the attempts it will work.