Forum Discussion

Evan_Champion_1's avatar
Evan_Champion_1
Icon for Cirrus rankCirrus
Jan 04, 2016

Kerberos and APM-based SAML IdP

I am stuck getting transparent Kerberos authentication to work with my F5 APM-based SAML IdP. The user's first access to the IdP is successfully transparently authenticated. Following session expir...
BIG-IP Access Policy Manager (APM)
saml
security
Evan_Champion_1's avatar
Evan_Champion_1
Icon for Cirrus rankCirrus
Sep 13, 2016

Most of my APM issues were resolved by upgrading to 12.1.0. I would recommend 12.1.1 for new users of APM SAML as it fixes at least one other issue.

 

Sergi_Munyoz_24's avatar
Sergi_Munyoz_24
Icon for Nimbostratus rankNimbostratus
Mar 27, 2017

Yes both, I did follow: https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-12-1-0/29.htmlconceptid

 

Now I want to use kerberos for AD users on internal network instead of logon form

 

If users reach webtop they are not prompted for auth, kerberos works fine. And they can launch IdP-initiated saml resources But if user goes to login.microsoftonline.com f.ex. and gets redirected to idp.xxx.com gets a prompt for auth. In other SP-initiated prompt does not appear but browser gots hung in redirectorpost url A simple apache frontend html doc with shibboleth SP works