Setting up CAS server with certificate based authentication

Hello,

This is a common scenario where you configure client cert authentication on the F5 VIP protecting the pool of CAS servers.

The client cert auth is feasible using LTM only by correctly setting up a client ssl profile.

But the Web SSO feature require APM module. If you ask only client certificate, so you must configure Kerberos Delegation on the BIG-IP and activate Kerberos authentication on the CAS servers.

I suggest you to add the UPN or the e-mail address of the user within the certificate so that by doing an AD query, you can retrieve all required attributes.