Forum Discussion
NimbostratusGetting issue with certificate based authentication of BIG IP APM
Am doing certificate based authentication of BIG IP APM with the help of on demand certificate documentation in the f5 official web site...but they authentication getting failed and getting the error like "Access policy denied "... the below are the logs..please tell me the exact procedure how to achieve the certificate based authentication {/Common/SAS_OWA_Policy:Common:ff7ab97a: Received User-Agent header: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36. 2016-03-09 00:55:22 /Common/SAS_OWA_Policy:Common:ff7ab97a: New session from client IP 202.122.134.254 (ST=Queensland/CC=AU/C=OC) at VIP 10.0.1.102 Listener /Common/SAS_SAML_VS (Reputation=Unknown) 2016-03-09 00:55:27 /Common/SAS_OWA_Policy:Common:ff7ab97a: Following rule 'fallback' from item 'On-Demand Cert Auth' to ending 'Deny' 2016-03-09 00:55:27 /Common/SAS_OWA_Policy:Common:ff7ab97a: Access policy result: Logon_Deny 2016-03-09 00:55:27 /Common/SAS_OWA_Policy:Common:ff7ab97a: Received client info - Hostname: Type: Mozilla Version: 5 Platform: Win7 CPU: unknown UI Mode: Full Javascript Support: 1 ActiveX Support: 0 Plugin Support: 1 2016-03-09 00:55:28 /Common/SAS_OWA_Policy:Common:ff7ab97a: Session deleted (policy_result). 2016-03-09 00:56:06 /Common/SAS_OWA_Policy:Common:ff7ab97a: Session statistics - bytes in: 12809, bytes out: 5339}
1 Reply
SmithyCirrostratus
Check out: https://devcentral.f5.com/articles/apm-cookbook-on-demand-vpn-for-ios-devices
Follow Steps 1 & 2 to setup the Client SSL Profile. Then add the On-Demand Cert Auth, start of step 3.5 & 3.6. You will need to perform a Kerberos SSO to OWA. So have a look at https://devcentral.f5.com/articles/apm-cookbook-single-sign-on-sso-using-kerberos, replace Sharepoint with OWA.
