Seamless athentication to Webtop

"You could also technically perform the IdP functions in APM "

 

is exactly what I want to do! :)

 

The key here is the transparency...

 

Okay, I need to try and implement the Kerberos part, you caveated the official guide well :)

 

Kevin,

 

As I try to implement this I've thought of a couple of more scenarios, that you might be able to confirm up for me:

 

"You're going to log in to the APM webtop seamlessly by virtue of Kerberos authentication from your domain-joind workstation."

 

This is exactly what I want to do. However would I also be able to have a fall back to the standard login page here if I accessed my webtop from a non corporate/non domain joined workstation, where attempting kerberos auth would fail?

 

And secondly (i might not be explaining this very well). Could I still access my SAML protected resources (SaaS based applications available over the Internet) seamlessly without having to seamlessly login to my webtop first (lets say I fired it straight from my browser favourites) from a domain joined machine? So the flow, I expect, would be from domain joined machine to Saas app, SaaS app redirects back to my iDP for auth, iDP does auth via Kerberos, SaaS app lets me in without requiring manual credential input. The next query would then be if I was on a non domain joined workstation accessing SaaS apps would that auth be able to failback to a login page, as the iDP is trying to do auth via Kerberos in the first instance?

 

Thanks for your help! I'm hoping I've come to the end of the road in terms of scenarios! :)

 

However would I also be able to have a fall back to the standard login page here if I accessed my webtop from a non corporate/non domain joined workstation, where attempting kerberos auth would fail?

 

In the visual policy for your IdP, you can configure the 401 agent to send Kerberos tickets to the Kerberos Auth agent, and anything else (fallback) to a standard logon page. The only thing you really have to worry about here is 1) the SAML trust between the IdP and SP(s), and 2) how you authenticate users at the IdP. Regardless of where the user is coming from, if he accesses a SAML-integrated application, he'll be redirected to the IdP for authentication. Once that happens and the user is properly authenticated, he'll be sent back to the SP with an assertion and access should be granted.

 

so, correct me if I'm wrong then, the way I have currently set it up and its working (before looking into Kerberos at all) is that I get a Logon Page for my webtop (regardless of user location/domain joined). Once user logs into this, he's good to go with all currently assigned SAML based resources. The same "logon page" credentials he inputted pass him through without a secondary login required at the iDP (also hosted on the same F5 device hosting the webtop) when authenticating SAML based resources clicked off of the webtop presented to the user.

 

Now, when I hopefully get Kerberos working to seamlessly authenticate the webtop for domain joined machine, or fall back to a login page for non domain joined machines, my SAML resources (either directly accessed or accessed via Webtop) should continue to allow seamless access I'm assuming either by virtue of Kerberos Auth or by the User being authenticated by the F5 logon page? I'm hoping both methods will authenticate the resource properly to not throw up a login to the iDP when currently configured SAML resources are being accessed