Forum Discussion
GNS_172075
Nimbostratus
NimbostratusF5 APM || Multi domain support
Hi, I'm new to APM. We are doing a POC in our lab using F5 APM v11.6 to integrate with 2010 CAS for Outlook web app service.
Our AD infra have 3 domains in the same forest with bi-direction implicit trust.
Now the requirement is to get the user authentication by using his AD login id & pwd without using the domain name as the third option. Without selecting the domain name in the login page, we have to set the APM to query all the 3 domains and authenticate if the account is found in any one of the 3 domains.
pls let me know how this can be achieved? will querying all the 3 domains will be an ineffective way (will that coz delay in authentication), also would like to know if we have a better option to get this enabled.
Summary: Objective: user will key in only his domain id and pwd, without specifying the relevant domain name. APM should be able to identify the users domain (within the 3 domains available) and then authenticate to that domain using the key provided by the user in the login page.
Exmaple: "usera" - in "domain a" "userb" - in "domain b" "userc" - in "domain c"
domain a, b and c are in the same forest and have implicit trust.
users login in only with their username/pwd, so APM should find that "usera" is part of "domain a" and then authenticate him.
I hope the part 3 series of the below URL should have that info, but I'm no able to find that in my search. https://devcentral.f5.com/articles/apm-cookbook-multiple-domain-authentication-part-1
If you have no logic to determine whether a given username is in domain a, b, or c, you have no choice but to query them all. Inefficient or not, it is your only option. You could store a username/domain database cache on the BIG-IP in the form of a datagroup and use an irule to lookup the correct domain, but you would be responsible for maintaining and keeping it current, and what happens if a given username is in multiple domains?
Just have fallback a go to b, and fallback b go to c. Fallback of c (failed all three) is Deny. All the rest are Accept. Yes it will be slower for b and slowest for c, but it is your only option given your requirements above.
