Forum Discussion
Preet_pk
Cirrus
CirrusF5 APM AD login
Hi Team, As part of APM AD integration - i am able to login with SAM Account user to logon page. But with email address it is failing. How to allow email id user login?
Preet_pkCirrus
CirrusThanks for above configuration details shared, email login is working now. I am now adding radius auth after AD Auth for MFA authentication which is failing with email id (Access-Reject). Please let me know the modification to be made for Raduis authentcation for email id.
Lucas_Thompson
Employee
EmployeeThat question is significantly more complicated, because it involves figuring out whatever specific attribute-ID/value pairs work with your specific RADIUS server. Luckily the RADIUS protocol can be viewed easily with wireshark. This article (and others that discuss RADIUS and APM) should help:
You'll also need to make sure you have your RADIUS server admin to help with the shared-secret and the allowed-client list on the server.
- Preet_pk
Hi Lucas_Thompson ,
Actually, radius authentication (MFA) is working fine with username, but failing with email-id. Is there any modification required on Radius Auth for email login to be successful.
- Lucas_Thompson
Think of the APM access policy as a flowchart (it looks like one). Each item in the flowchart has 3 stages:
1- Begin processing the item.
2- If there is an agent assigned to this item, execute it. After execution, set the session variables for the agent.
3- Evaluate each branch rule, in order. If it evaluates to true, then follow that branch to the next item. If no items match, go to the fallback item.
You'll need to figure out how to think about your policy from this perspective to troubleshoot it. The /var/log/apm file (at informational level) contains detailed logs for each stage of each item for each user session, and an ending summary of all policy items executed. You'll need to consult these logs to fully understand how your user sessions are processed. Once you understand the session flow and what items/agents are setting what session variables, it should be much easier to understand.
- Preet_pk