For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

almerbiner_2104's avatar
almerbiner_2104
Icon for Nimbostratus rankNimbostratus
Jul 14, 2015

Use of big-IP APM to replace an ADFS between on-premise and Azure AD Premium

Dear all

 

We are currently designing the Authentication & Authorization model of a new web solution and I have the following questions that are key before making the final choice. The reference registry for all the users will be Azure AD Premium. We haven't completely decided yet if we will go for SAML or OpenID/OAUTH2 regarding the AAA protocol, but it seems SAML is more adapted to our needs. hence the questions below are more SAML related.

 

The token generation can be handled either by Azure AD or a local AD that is federated with Azure. Microsoft recommends the second option though I don't know the exact reasons.

 

Anyway, the questions regarding Big-IP are:

 

  • When we talk about APM replacing ADFS, does it simply sync the tokens that are generated by the main AD or can it act as the token provider itself ?
  • What are the pros & cons of having Big-IP handling that completely with the Azure AD compare to connecting the APM to a local ADFS (federated with the Azure AD) ?

3 Replies

    • sercacor's avatar
      sercacor
      Icon for Nimbostratus rankNimbostratus
      Aug 02, 2016

      I am also interesting in this scenario. Any feedback?

       

  • Algebraic_Mirror's avatar
    Algebraic_Mirror
    Icon for Cirrostratus rankCirrostratus
    Aug 22, 2016

    To answer your first question, APM acts as a SAML IDP. It will generate SAML claims for you, which your users will be able to present as tokens to federated sites.

     

    As for your second question, I think Azure AD has limitations compared to on-prem AD, and also, to have users in Azure AD I think you have to periodically sync them to Azure AD from your local on-prem AD, which is your source of truth. APM is nice because as a SAML IDP, when a user types in their username and password, APM will directly authenticate them against your local active directory servers, and then issue them their SAML claim. There won't be any need to synchronize users up to Azure AD, and Azure AD won't be needed by APM (now whether there are reasons to put users in Azure AD that don't involve APM, I can't advise you, but APM has no need of Azure AD).