Forum Discussion
Marvin_129795
Nimbostratus
NimbostratusF5 APM retrieve AD groups and resend using HTTP POST parameter
Dear all,
I am looking at a particular situation where an internal web server needs to know what kind of AD membership groups are assigned to a user that tries to login. The authentication only takes place on the F5 APM and NOT on the internal server. The internal server only needs to verify AD group membership, but may not communicate to AD.
The idea is to:
- Create a login page using APM
- authenticate using username and password to AD
- Retrieve the AD group membership
- Include a POST parameter with these AD group membership information and send it to the internal webserver
Somebody already had a similar situation before?
Yes this is fairly simple. Use LTM+APM mode, and AD Query / AD Auth in your Access Policy. Set the "start uri" parameter to your backend app's URI, and use forms-based SSO (server-initiated) to fill in the resultant session variables from your AD Query into your form parameter. The groups will be in the form of a pipe-delimited list of the group DNs that came back from the query.
MarvinCirrocumulus
Hi Dan, yes that is correct.
Yes this is fairly simple. Use LTM+APM mode, and AD Query / AD Auth in your Access Policy. Set the "start uri" parameter to your backend app's URI, and use forms-based SSO (server-initiated) to fill in the resultant session variables from your AD Query into your form parameter. The groups will be in the form of a pipe-delimited list of the group DNs that came back from the query.
- Marvin
I guess this function Logout URI Include in the Access policy?
 
https://devcentral.f5.com/s/feed/0D51T00006i7dF0SAI
 
- Marvin
Hi Lucas another question, there is still some tuning to do, like when the user logs off the session within the applciation it remains active on the F5 side.
How can I make sure that the F5 will close the session when the client logs off within the application?
Is it perhaps needed to change the portal type so it will show the F5 logoff button in the upper menu and the customer needs to logoff using the F5 logoff button. In LTM+APM mode I don't see this menu bar.
Any ideas?
Great! Thanks for reporting back. You can use that curly brace in a lot of different places in APM for session variable substitution. It's pretty useful for different stuff.
Hi Marvin,
Is this to say the first request to the backend server must be a POST, and that POST must contain AD group membership?
Dan
