Forum Discussion

Cumulonimbus

Jun 11, 2019

Google Authenticator implementation

Hello, we want to configure MFA/2FA using Google Authenticator (or at least the underlying time-based one-time password (TOTP) solution). We found several articles and guides here on DevCentral, bu...

BIG-IP Access Policy Manager (APM)

Cumulonimbus

Hi Denis,

it's quit some months ago and I currently can't remember exactly, but I think I used the code provided from Niels above as well.

In general our logic now works as follows:

User gets APM Login-Page displayed, where normal AD-credentials need to be entered
Credentials will be checked via AAA-profile
If successful a newly created AD-attribute for the shared secret will be checked
If available, the OTP will be created via iRule and requested in parallel from the user on a second APM-page -> if both are identical access is granted
If not available, APM via iRule/iRuleLX will create a new shared secret for that user and displays the result on a second APM-page -> once the user confirms that he's activate this key on his mobile-app, APM will update the AD and saves the shared key for that user -> additionally the OTP will be created and requested from the user as mentioned above

So each user has to initialize his own OTP-app the first time he uses a MFA-protected VS. APM will manage all the users automatically via AD-Attribute.

Hope that helps a little bit more.

Ciao Stefan :)