Privileged Access in Action: Technical Controls for Real-World Environments

Introduction

This article provides a technical walk-through demo to implement Privileged User Access (PUA) with BIG-IP APM.

In modern IT environments, privileged user access refers to elevated permissions granted to administrators, engineers, and service accounts that manage critical infrastructure, applications, and data. These accounts can bypass standard security controls, modify configurations, provision resources, and access sensitive systems. This makes them a high-value target for attackers. 

From domain admins in Active Directory to root accounts on Linux servers and cloud (Identity Access Management) IAM roles, the scope of privileged access spans on-prem, hybrid, and cloud-native stacks. As environments scale and become more dynamic, especially with DevOps and automation, controlling and auditing privileged access is no longer optional. It’s a foundational requirement for operational integrity, threat detection, and zero trust security.

Video provider requires cookies to play the video. Accept to continue or watch it directly on the provider's site.

Accept

Listing some of the common use cases for PUA, 

BIG-IP APM & PUA

BIG-IP APM provides Privileged User Access so that you can add CAC authentication (Common Access Card), Personal Identity Verification (PIV), or other strong authentication method to network infrastructure for enhanced security.

This solution integrates directly into DoD PKI systems and works cooperatively with existing RADIUS, TACACS, Active Directory, and a variety of third-party authentication databases.

Deployment of Privileged User Access requires a license and involves the configuration of these components:

• Ephemeral Authentication
• ServerWebSSH
• ProxyAuthentication Server (for RADIUS and/or LDAP or LDAPS)

What is Ephemeral Authentication? 

The Privileged User Access license lets you create an Ephemeral Authentication server that generates and manages temporary or ephemeral passwords.

BIG-IP APM acts as the Ephemeral Authentication server. It ensures a secure end-to-end encrypted connection while eliminating the possibility of credential reuse. The Ephemeral Authentication server includes the access profile/policy that authenticates the end user and contains the webtop resources for ephemeral authentication (so the server also acts as a webtop proxy).

Going through the traffic flow steps below, 

1. User logs into the APM virtual server using a Smartcard or other credential. (The APM virtual server is the one that acts as the Ephemeral Authentication server on which the APM access profile/policy is configured.)
2. The APM access policy checks provided credentials and retrieves AD/LDAP group membership information and returns a webtop showing backend resources.
3. When the user clicks on a resource, APM generates an ephemeral password, and saves the username and password.
4. Using SSO, APM signs the user on to the WebSSH virtual server with their ephemeral authentication credentials. At this point, portal access can be used instead.
5. WebSSH makes an SSH connection (or HTTPS) to the router/server still using the ephemeral authentication credentials.
6. The router sends an authentication request to the RADIUS or LDAP virtual server.
7. The RADIUS or LDAP virtual server verifies the ephemeral password.
8. The RADIUS or LDAP virtual server returns a Successful or Failure response.
9. The SSH (or HTTPS) session is established or denied.

For technical implementation, please review our demo here and go through our technical documentation

Securing Privileged User Access Concepts 

Related Content

• Privileged User Access 
• BIG-IP Access Policy Manager: Privileged User Access 
• BIG-IP APM and PUA licenses