For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Willian_Guilher's avatar
Willian_Guilher
Icon for Cirrus rankCirrus
Aug 21, 2014
Solved

Remote Active Directory Authentication w/ e-mail address

Hello Guys, I came across a question from a customer today where we've configured Active Directory authentication for users login into the BIGIP. It is working perfectly with no problems. The custom...
application delivery
LTM
management
  • Willian_Guilher's avatar
    Willian_Guilher
    Aug 21, 2014

    Hey Guys, thank you very much for your help. @nitass your configuration is perfect and worked like a charm. I initially used the following lines, but it did not work even with the userprincipalname because I had the"user-template" configured.

    root@(bigip1)(cfg-sync Standalone)(Active)(/Common)(tmos) list auth ldap system-auth auth ldap system-auth { bind-dn cn=administrator,cn=users,dc=f5demo,dc=com bind-pw $M$Xz$R6vSMU6JwXX/2bq2Cksu/g== login-attribute userprincipalname search-base-dn cn=users,dc=f5demo,dc=com servers { 192.168.1.100 } user-template %s@f5demo.com

    My new configuration is just like yours.The "User-Template" should be left blank otherwise it will make the BIGIP to use only the userid instead of the combination userid + DN.

    Working configurtion root@(bigip1)(cfg-sync Standalone)(Active)(/Common)(tmos) list auth ldap system-auth auth ldap system-auth { bind-dn cn=administrator,cn=users,dc=f5demo,dc=com bind-pw $M$vD$R97Nbf7gLgGgbO44TBHByA== login-attribute userprincipalname search-base-dn cn=users,dc=f5demo,dc=com servers { 192.168.1.100 }

    ![Image Text](/Portals/0/Users/187/75/146875/ScreenShot2014-08-20at9.00.53PM.png)

Thank you very much fellows ;)
nitass's avatar
nitass
Icon for Employee rankEmployee
Aug 21, 2014

this is mine.

 config

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list auth ldap system-auth
auth ldap system-auth {
    bind-dn cn=administrator,cn=users,dc=abc,dc=com
    bind-pw $M$g2$cTattFzOwB2DzL4ywm9bXQ==
    login-attribute userprincipalname
    search-base-dn cn=users,dc=abc,dc=com
    servers { 172.28.24.5 }
}

 test

login as: tasmania@abc.com
Using keyboard-interactive authentication.
Password:
Last login: Wed Aug 20 19:31:05 2014 from 192.168.207.69
tasmania@abc.com@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos)