For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Jul 14, 2016

I'm assuming you are talking about AAA (frontend user auth, not SSO).

APM has two functions geared toward AD: AD Auth and AD Query. AD Auth uses the end user's credentials collected from a logon page and put into session.logon.last.username and session.logon.last.password, then transmits those via Kerberos to the specified AD server.

AD Query uses Kerberos to authenticate to an LDAP service on AD to issue queries. The creds from the AAA AD Server definition will be used. If it's empty, then the user's creds will be used.

I think this is covered pretty well in the manual, but you may want to review the APM Operations Guide which has a technical overview. If you feel like the information there is incomplete or confusing, please let us know and we'll update it as required:

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/f5-apm-operations-guide.html