Forum Discussion
Vulcana
Altostratus
AltostratusF5 APM with OIDC Web Duo Prompt
DUO is retiring the iFrame support which has been working well for us. I am trying to implement the replacement found at https://duo.com/docs/f5bigip-web and APM Configuration to Support Duo MFA usi...
For those who may run into this in the future sometimes it can be difficult to distinguish a _ from a - in the article. Should you run into this check for
- client_id parameter with type client-id
- response_type parameter with type response-type
- grant_type parameter with type grant-type
- redirect_uri parameter with type redirect-uri
VulcanaAltostratus
AltostratusFor those who may run into this in the future sometimes it can be difficult to distinguish a _ from a - in the article. Should you run into this check for
- client_id parameter with type client-id
- response_type parameter with type response-type
- grant_type parameter with type grant-type
- redirect_uri parameter with type redirect-uri
ThanuNimbostratus
Hi,
We have configured F5 APM with Duo Universal prompt. When I try to access VDI, it gives login page and then redirects to api host but gets 404 error, Can anyone help me with this? I have been troubleshooting this but not getting anywhere.
Thanks in Advance!
- Vulcana
As a 404 is not found I would check to make sure that you have correctly copied the API host name. This would be api-xxxxx.duosecurity.com in the URLs authentication and token URLs during the OAUTH provider configuration step. Make sure auto JWT is off.
Also check in the JSON web token creation step as that uses the API host name as well.
Finally double check that name in the irule. (around line 40)
I hope that gives you places to dig. Good luck.
- Thanu
Thanks for the quick response!
I copied again and updated the api host api-xxxxx.duosecurity.com.
On the iRule also I did change to api-xxxxx.duosecurity.com. After changes, it redirects to Duo.com page appended with our CLIENT ID.
Suspecting API is found but client ID is hitting DUO page.
Do we need to change or check anything from Duo side?
Just another Question- While creating iRule event on VPE, ID should be iRule name, is it?