Two Factor Authentication

You could try to build the Access Policy like you would with 2FA with RSA and AD Auth. Instead you will use Radius Auth and HTTP Basic Auth. But the flow would be more or less the same.

See: https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-0/6.html

Hi Niels,

Thanks for your answer. The thing is that, once the Radius has authenticated the OTP, the F5 has to send a GET Request to the Web Server with an "Authorization" Header. I'm not sure if I should use the HTTP Authentication (ie: Access => Authentication => HTTP) or the SSO HTTP (ie: Access => Single-Sign-On => HTTP Basic). I guess that the second one is the correct one.

Right now I'm looking to add some debugging information into the Access Profile to understand where the process fails.

Best Regards,

Jean-Christophe Valiere

Hi Jean-Christophe,

HTTP Authentication will only validate credentials to an external web-based server. You can use this external web-based server to authenticate an user, but it will not necessarily be the service or application the user will be granted access to. With SSO HTTP, the authenticated credentials will be reused to login to the service or application.

So you can have two (or maybe more) scenarios:

1) Radius Auth performing 2FA (Username/Password auth and Token challenge) + HTTP SSO

2) Radius Auth performing 1FA (token auth) + HTTP Auth 1FA (username/password auth) + HTTP SSO

Kind regards,

--Niels

Hi Niels,

Thanks a lot for your support. I went throuhg option 2) and it's working fine.

Best Regards,

Jean-Christophe