BigIP APM - AD & RSA auth

Do you want to present a logon page where the user enters user/pass and PIN? If so, try this:

1. In the visual policy editor, start with your logon page and add a third field (we'll call it "token") - of type password.

2. Both AD auth and SecurID agents use the session.logon.last.password session variable, so after the logon page, save the logon page's password to a separate session (temporary) session variable, re-assign session.logon.last.password to be the token value from the logon page, and pass this to the RSA SecurID agent.

   session.logon.temp.password = mcget {session.logon.last.password}
   session.logon.last.password = mcget {session.logon.last.token}
   

3. Out of the successful branch of the SecurID agent, swap the variables so that the user's password is back in the session.logon.last.password session variable, and pass to AD Auth.

   session.logon.last.password = mcget {session.logon.temp.password}
   

This should get you through both auth agents.