For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nath's avatar
Nath
Icon for Cirrostratus rankCirrostratus
May 10, 2022

SAML F5 as SP initiated with Azure MFA Integration

Hi Experts,

I am deploying F5 as SP with Azure MFA, during the deployment we encountered this behavior below(which is expected):

  • User access F5 VPN, F5 authenticates users thru local AD
  • Users will redirect to Azure MFA for a second verification
  • Users will key in their Azure account and Azure will send SMS OTP
  • Once verified, users can access applications behind F5 APM

The issue we encountered is when the user login for the 2nd time, there was no challenge/authentication presented to the users, we guess it's because of the SSO or cookie session on the Azure.

  • User access F5 VPN, F5 authenticates users thru local AD
  • Users will redirect to Azure MFA (no verification/authentication)
  • Users can access F5 APM

After we noticed the behavior above, we used the force authentication option in the F5 SAML configuration (which seems to be the answer):

However, we want to minimize the user effort because every time they are redirected to Azure MFA they need to key in their Azure credentials (username & pass).

My question is, is there a way to pass the credentials from the F5 logon page to the Azure MFA login portal thru SAML.

3 Replies