Forum Discussion
Raghbir_Sandhu
Altocumulus
AltocumulusRadius Authentication with Microsoft NPS and Azure MFA not working
We have configured F5 with Microsoft NPS to leverage Microsoft Azure AD MFA. F5 is sending Radius authentication request to Microsoft NPS server. However NPS server error. Looks like NPS server with ...
which version are you on? I can see this feature from 13.x and onwards.
By default apm uses session.logon.last.username variable for username. See if you can set custom APM variable for it and change it to UPN variable you get after LDAP query.
Raghbir_SandhuAltocumulus
AltocumulusSanjay. Thanks for the reply. How do i get username source and password source attributes in my radius AAA in VPE. how to add the two attributes.
spalande
Nacreous
Nacreouswhen you select radius auth action in access policy those variables are added by default. You can read more below
- Raghbir_Sandhu
Sanjay, I don't see the additional two attributes. see the attached screenshot.
- spalande
which version are you on? I can see this feature from 13.x and onwards.
By default apm uses session.logon.last.username variable for username. See if you can set custom APM variable for it and change it to UPN variable you get after LDAP query.
- Raghbir_Sandhu
we are using 12.1.5.3. May be that's why I don't see two additional variables. what the question remain same. The radius request attribute name is "User-Name". can i just assign UPN value to the "User-Name" attribute via variable assignment step. before the MFA step. Please advise.
- spalande
- LDAP query to get UPN
- Set custom variable for session.logon.last.username to UPN variable
- Radius auth
- spalande
Have you made this working? It would be good to share your solution, it may benefit others using similar setup. Thanks!
- Raghbir_Sandhu
Yes. It is working. I ended up creating registry entry "LDAP_ALTERNATE_LOGINID_ATTRIBUTE". Some how our NPS not able to process the User-Name attribute properly passed from F5 Radius authentication request. That fixed our problem and I don't have to do the LDAP query for UPN attribute.
Thanks,
Raghbir Sandhu