For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

almerbiner_2104's avatar
almerbiner_2104
Icon for Nimbostratus rankNimbostratus
Jul 14, 2015

Use of big-IP APM to replace an ADFS between on-premise and Azure AD Premium

Dear all   We are currently designing the Authentication & Authorization model of a new web solution and I have the following questions that are key before making the final choice. The reference r...
Algebraic_Mirror's avatar
Algebraic_Mirror
Icon for Cirrostratus rankCirrostratus
Aug 22, 2016

To answer your first question, APM acts as a SAML IDP. It will generate SAML claims for you, which your users will be able to present as tokens to federated sites.

 

As for your second question, I think Azure AD has limitations compared to on-prem AD, and also, to have users in Azure AD I think you have to periodically sync them to Azure AD from your local on-prem AD, which is your source of truth. APM is nice because as a SAML IDP, when a user types in their username and password, APM will directly authenticate them against your local active directory servers, and then issue them their SAML claim. There won't be any need to synchronize users up to Azure AD, and Azure AD won't be needed by APM (now whether there are reasons to put users in Azure AD that don't involve APM, I can't advise you, but APM has no need of Azure AD).