Forum Discussion

hassan_36762's avatar
hassan_36762
Icon for Nimbostratus rankNimbostratus
Mar 14, 2010

SMS challenge with F5 LTM

Hi,

 

 

I have been able to configure the LTM to authenticate users via radius before accessing the hosted web applications.

 

 

Our radius implementation integrates with a backend SecureID database to provide OTP and so far it has been working perfectly

 

 

We are currently looking at introducing an SMS token option, THe scenario goes like this

 

 

1. a user comes to the address of the web application

 

2. The F5 intercepts the request and offers the client a pop up challenge window (basic authentication I believe)

 

3. The user inputs the username and a pin code

 

4. the radius (upon verifying the previous info) sends an additional challenge (for the sms token)

 

5. The user receives an sms and inputs it to another window on the F5

 

6. The radius verifies the additional challenge and grants the user access.

 

 

My questions are:

 

 

1. is such setup possible

 

2. is it supported out of the box or some iRule development needs to be done

 

3. are we able to use form based authentication (i.e present a separate webpage to the user with customized messages) and if so can it be hosted on the F5 box itself or does it have to be hosted separately

 

 

 

Appreciate your valuable input

 

 

Hassan

 

config
design

2 Replies

Sort By
  • soymanue's avatar
    soymanue
    Icon for Nimbostratus rankNimbostratus
    Dec 29, 2011
    Hi

     

    I have a very similar problem.

     

    Did you mananage to solve?
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 29, 2011
    Hi Manuel,

     

     

    Per Boe an F5 FSE and Jason Rahm from DC, posted a solution on using APM to implement an SMS based one time password solution:

     

     

    One Time Passwords via an SMS Gateway with BIG-IP Access Policy Manager

     

    http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086432/One-Time-Passwords-via-an-SMS-Gateway-with-BIG-IP-Access-Policy-Manager.aspx

     

     

    And George Watkins has something related for LTM and Google soft tokens. I believe this will require the advanced client auth license.

     

    http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086517/Two-Factor-Authentication-With-Google-Authenticator-And-LDAP.aspx

     

     

    Aaron