APM Configuration to Support Duo MFA using iRule

Overview BIG-IP APM has supported Duo as an MFA provider for a long time with RADIUS-based integration. Recently, Duo has added support for Universal Prompt that uses Open ID Connect (OIDC) protoco...
0151T0000040JicQAE.png
Updated Nov 27, 2024
Version 7.0
BIG-IP
BIG-IP Access Policy Manager (APM)
big-ip apm
duo
iRules
mfa
OAuth Client
security
JHDUKE's avatar
JHDUKE
Icon for Altostratus rankAltostratus
Jul 15, 2024

I've got this configured and working on version 17 however there's something about the syntax of the irule that version 17 doesn't like. A 'tmsh load sys config verify' returns warnings for each procedure call and not fluent enough with irules to make the necessary adjustments. Everything works as expected but would like to clean up the warnings as I use the config verify often. Any suggestions would be appreciated.. 

Validating configuration...
  /config/bigip_base.conf
  /config/bigip_user.conf
  /config/bigip.conf
There were warnings:
/Common/Duo_MFA_iRULE:3: warning: [The following errors were not caught before. Please correct the script in order to avoid future disruption. "unexpected end of arguments;expected argument spec:PROC_SCRIPT"130 50][proc getClientId {
 return oauthsecret
}]

  • Lucas_Thompson's avatar
    Lucas_Thompson
    Icon for Employee rankEmployee
    Sep 20, 2024

    You need to make two edits to the iRule with your tenant information:

    proc getClientId {
     return "PUT YOUR TENANT'S CLIENT ID HERE"
    }

    proc getJwkName {
     return "PUT THE BIG-IP OBJECT NAME FOR THE JWK HERE"
     #e.g. return "/Common/duo_jwk"
    }

     

    • JHDUKE's avatar
      JHDUKE
      Icon for Altostratus rankAltostratus
      Sep 26, 2024

      Thanks for the response. I do have these already configured in the iRule. The warnings seem to be associated only with the 'proc' definitions.. 

       

      • cjrnz's avatar
        cjrnz
        Icon for Nimbostratus rankNimbostratus
        Nov 08, 2024

        I get the same warnings, still on version 15 here but in the throes of planning to move to 17 which is where I noticed the warnings.  The script itself works fine.