For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

spalande's avatar
spalande
Icon for Nacreous rankNacreous
Apr 21, 2021

What is the backend server auth for EV? What's the expectation of standalone EV VIP​, if accessed directly?

Depending on auth need of EV VIP, you can configure new Access policy for it. (e.g. Kerberos SSO on clienside and Kerberos SSO on serverside.)

​

Then, for SSO between OWA and EV you can use single domain cookie (example.com) on both access policies. SSO should work if user access EV link from OWA session.

​​

please go through the link provided.

 

https://clouddocs.f5.com/training/community/iam/html/archived/class7/module1/lab7.html

​

Basavaraj's avatar
Basavaraj
Icon for Altostratus rankAltostratus
Apr 21, 2021

Dear Sanjay,

 

The backend server for the EV VIP is the actual EV server ( Enterprise vault Server ), for the OWA we have configured Kerberos authentication, EV will be working as a plugin within the owa page, when the user wants to open any archived email he will click on the enterprise vault plugin from owa it will open a connection to EV server IE ev.example.com, this session should work without asking for any credentials and should use previously authenticated owa session, actually this is what my goal is

 

Thanks

Basavaraj

  • spalande's avatar
    spalande
    Icon for Nacreous rankNacreous
    Apr 21, 2021

    I understand, what I meant was whatever EV server is using for authentication either windows integrated or forms based, you can bring it behind F5 APM (new access policy) and use single domain SSO cookie (example.com) on both policies (OWA and EV) and it should work.

     

     

    Now, this is the one way I know to have SSO working between F5 APM sessions for 2 applications. If someone else has any other thoughts we will wait for their feedback.