Forum Discussion
NimbostratusF5 APM HTTP Form Based Authentication
CirrocumulusHello Vinodh,
There is a well-documented method for performing authentication from multiple AD domains using user input that Cody Green posted, Multiple Domain Authentication but this method does rely on user input and would not be transparent to your end-user.
There's no particular reason this VPE set-up can't be changed to other forms of authentication as well, including your Cloud authentication. From the sound of it, you might want to look into setting up a SAML federation, with the F5 as a service provider and whatever cloud authentication system you have as the identity provider.
At a high-level, users would hit your logon page, and select either local or cloud authentication. Based on that setting, the user would navigate to either your Local AD auth or your Federated auth.
Best of luck,
Austin
vinodhkumarc_28Hi Austin,
Thanks a lot for your reply.
The issue here is the legacy application is integrated with local AD and the IT Security team now wants to remove the contractor accounts from local domain. But, there is no way for the application authentication to be altered due to limitations. Now, we will be able to authenticate contractors with external authentication integrating with F5, but to access the legacy application still the connection requires a local AD account, which prompts for username/password page. So I was checking if its possible to insert a service account using iRule to all successfully authenticated contractor sessions to allow access to the legacy application.
Regards, Vinodh
- AMiles_377865
Thank you for clarifying Vinodh, I understand your problem a little better. I can't think of any way to dynamically insert the credentials into AD transparently. Any solution i can come up with involves changing the configuration of the AD auth at least a little, which is against your limitations.
The best thing I could imagine right now would be to call an iRule from an Agent Event after your consultants have successfully been authenticated. This would assign them the variables needed for the shared service account. But without re-configuring the legacy AD for SSO I'm not sure you can do anything with that beyond having the user log in manually. This could maybe be done by having a message box provide the contractor with the login info, though this solution is not very secure.
Let me know if you figure something out. I'd be interested in whatever solution you come up with.
