# Azure Active Directory and BIG-IP APM Integration with PeopleSoft

**URL:** <https://community.f5.com/t/azure-active-directory-and-big-ip-apm-integration-with-peoplesoft/67856>\
**Category:** F5 Technical Articles\
**Tags:** big-ip-access-policy-manager-apm, security, series-f5-apm-and-microsoft-azure-ad-integration\
**Created:** [September 4, 2020, 7:04pm UTC](https://community.f5.com/t/azure-active-directory-and-big-ip-apm-integration-with-peoplesoft/67856 "2020-09-04T19:04:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kai\_Chung](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kai\_Chung](https://community.f5.com/u/Kai_Chung)\
**Post date:** [September 4, 2020, 7:04pm UTC](https://community.f5.com/t/azure-active-directory-and-big-ip-apm-integration-with-peoplesoft/67856/1 "2020-09-04T19:04:04Z")

</div>

## Overview

This guide is written for IT professionals designing an F5 network. These IT professionals can fill a variety of roles:

- Systems engineers requiring a standard set of procedures for implementing solutions
- Project managers creating statements of work for F5 implementations
- F5 partners selling technology or creating implementation documentation

### This guide covers using single sign-on to access the Oracle PeopleSoft application requiring header-based authentication.

 ![image_286268.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/a/a12caf9f59957cc22571395117f2fc5403719b61.png)

_Figure 1&nbsp;Secure hybrid application access_

## Microsoft Azure Active Directory and F5 BIG-IP APM Design

For organizations with a high security demand with low risk tolerance, the need to keep all aspects of user authentication on premise is required.

The Microsoft Azure Active Directory and F5 BIG-IP APM solution integrates directly into AAD configured to work cooperatively with an existing header based, header based or variety of authentication methods. The solution has these components:

- BIG-IP Access Policy Manager (APM)
- Microsoft Domain Controller/ Active Directory (AD)
- Microsoft Azure Active Directory (AAD)
- PeopleSoft Application (header-based authentication)

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/e/e7ce1bbd1c98bd58aff1f86de6b98268e0b13bb9.png)

_Figure 2&nbsp;APM bridge SAML to header authentication components_

## Deploying Azure Active Directory and BIG-IP APM integration

The joint Microsoft and APM solution allow legacy applications incapable of supporting modern authentication and authorization to interoperate with Azure Active Directory. Even if an app doesn’t support SAML, and only is able to support header-based authentication, it can still be enabled with single sign-on (SSO) and support multi-factor authentication (MFA) through the F5 APM and Azure Active Directory combination. Azure Active Directory as an IDaaS delivers a trusted root of identity to APM creating a bridge between modern and PeopleSoft applications, delivering SSO and securing the app with MFA.

## Configuring Microsoft Azure Active Directory

These instructions configure Azure AD SSO with APM to be used with PeopleSoft. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in F5.

**To configure and test Azure AD SSO with APM, complete the following tasks:**

- **Create an Azure AD user** &nbsp;– to add users to Azure AD.
- **Assign the Azure AD user** &nbsp;- to enable users to use Azure AD single sign-on.
- **Configure Azure AD SSO** &nbsp;- to enable your users to use this feature.

### Create an Azure AD user

In this section, you will create a test user in the Azure portal named Harvey Winn.

1. From the left pane in the Azure portal, click **Users** , and then select&nbsp; **All users**.
2. Click **+** &nbsp; **New user** &nbsp;at the top of the screen.
3. In the&nbsp; **User** &nbsp;properties, follow these steps:

- **Username** : [harvey@aserracorp.com](mailto:harvey@aserracorp.com)
- **Name:** &nbsp;Harvey Winn
- Select the&nbsp; **Show password** &nbsp;check box, and then write down the value that’s displayed in the&nbsp; **Password** &nbsp;box.
- Click&nbsp; **Create**.

## Assign Azure AD users to application

Step 1: In the search field, type “enterprise applications” and click on **Enterprise applications**.

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/b/bc2e0535f1a2b49d77b25a990ff1422aac767cae.png)

Step 2: Click on “New applications

![image_286303.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/9/92c49aee43acf18aafe276f58f57b333a21cba67.png)

Step 3: In the search field under **Add from the gallery** , type “f5” and click on **Oracle PeopleSoft - Protected by F5 Networks BIG-IP** and then **Add**.

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/2/2e88db7b068ffce934d48c12a9e3523e23d88f54.png)

Step 4: In the **Oracle PeopleSoft - Protected by F5 Networks BIG-IP | OverviewClick** window, click **1. Assign users and groups** , and in the next screen, click **+ Add user**.

Step 5: In **Home \> Oracle PeopleSoft - Protected by F5 Networks BIG-IP | Users and groups \> Add Assignment** page, click **Users and groups**.

Step 6: In the search field under Users and groups, search “harvey” and click on the user **Harvey Winn** , click on **Select** and then click on **Assign**.

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/b/5/b55d62e37c89d16b0953725517f706ec8f5e0dd5.png)

## 

Configure Azure AD SSO

Step 1: Click on **Single sign-on.**

![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/1X/5916afb240421fdb27095ac798b8d899291cdf2d.png)

Step 2: Click on **SAML.**

 ![image_286303.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/8/80d218a35f67c3b3b5dba2423d80f5226533ee2b.png)

Step 3: In **Home \> Oracle PeopleSoft - Protected by F5 Networks BIG-IP | Single sign-on \> SAML-based Sign-on** page, under **Basic SAML Configuration** , click the edit icon.

![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/optimized/2X/8/8c9a1eeb666726456d0d7213980ad1c1f7e61b3e_2_690x47.png)

Step 4: Complete the following information and click **Save.**

- **Identifier (Entity ID)**: [https://peoplesoft.aserracorp.com/](https://peoplesoft.aserracorp.com/)
- **Reply URL (Assertion Consumer Service URL)**: [https://peoplesoft.aserracorp.com/saml/sp/profile/post/acs](https://peoplesoft.aserracorp.com/saml/sp/profile/post/acs)
- **Relay State** : [https://peoplesoft.aserracorp.com/irj/portal](https://peoplesoft.aserracorp.com/irj/portal)
- **Logout Url** : [https://peoplesoft.aserracorp.com/saml/sp/profile/redirect/slo](https://peoplesoft.aserracorp.com/saml/sp/profile/redirect/slo)

Step 5: In **Home \> Oracle PeopleSoft - Protected by F5 Networks BIG-IP | Single sign-on \> SAML-based Sign-on** page, under **User Attributes & Claims** , click the edit icon, and click **+ Add new claim.**

Step 6: In **Home \> Oracle PeopleSoft - Protected by F5 Networks BIG-IP | Single sign-on \> SAML-based Sign-on \> User Attributes & Claims \> Manage claim** page, complete the following information and click **Save**.

- Name: sAMAccountName
- Source attribute: user.onpremisessamaccountname

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/c/c47157c8328e8faa63ca5bc0d826c5a2be321d81.png)

Step 7: Click **\> SAML-based Sign-on \>** , to verify information

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/5/50919b2fb5c02aeecc0e1ced71fbeac6be50c873.png)

Step 8: Under **SAML Signing Certificate** and next to **Federation Metadata XML** , click right click on **Download** and select **Save Link As…**

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/2/23e097602cd2ca395e07b0c9ba55898f00d12fa4.png)

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/8/8afbedd12dcb5d59fdcf95a7c5e8bd8ed7fac29d.png)

Step 9: Rename **File names** to remove spaces.  
Note: APM Guided Configuration will not accept spaces in the file name

This completes Azure AD configuration.

## Configure F5 BIG-IP APM

These instructions configure with APM to be used with Azure AD SSO for PeopleSoft application access. For SSO to work, you need to establish a link relationship between APM and Azure AD in relation to the PeopleSoft.

To configure and test Azure AD SSO with APM, complete the following tasks:

- **Configure the Service**  **Provider:** Service Provider can sign authentication requests and decrypt assertions.
- **Configure a Virtual Server:** When the clients send application traffic to a virtual server, the virtual server listens for that traffic, processes the configuration associated with the server, and directs the traffic according to the policy result and the settings in the configuration.
- **Configure External Identity Provider Connector** : Define settings for an external SAML IdP. When acting as a SAML Service Provider, the BIG-IP system sends authentication requests to and consumes assertions from external SAML IdPs that you specify.
- **Configure the Pool Properties:** enables you to configure a pool of one or more servers. If you have a suitable pool configured already, select it. Otherwise, create a new one. Add servers, select a load balancing method, and, optionally, assign a health monitor to the pool.
- **ConfigureSingle Sign-On:** leverages credential caching and credential proxying technology so users can enter their credentials once to access their secured web applications.

Step 1: In BIG-IP click **Access \> Guided Configuration \> Federation \> SAML Service Provider**.

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/8/87803cd96744e2518fb0c62fa3ed7e63fff82ca7.jpeg)

Step 2: Click **Next**.

 ![image_286303.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/a/f/afd5788aabe999dff4a9b6934da5d56f125ec58d.png)

Step 3: In the **Service**  **Provider Properties** page, configure the following information, leave default settings and click **Save & Next**.

- **Configuration Name** : PeopleSoft\_AAD\_APM
- **Entity ID** : [https://peoplesoft.aserracorp.com/](https://saperp.aserracorp.com/)
- **Scheme** : https
- **Host** : [peoplesoft.aserracorp.com](http://peoplesoft.aserracorp.com)

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/6/64e03458382ead96d8dd7ff1776676b47bc35c3c.jpeg)

Step 4: In the **Virtual Server Properties** page, configure the following information, leave default settings and click **Save & Next**.

- Destination Address: 206.124.129.124
- Service Port: 443 HTTPS (default)
- Enable Redirect Port: Checked (default)
- Redirect Port: 80 HTTP (default)
- Client SSL Profile: Use Exsisting
- Common: [peoplesoft.aserracorp.com](http://peoplesoft.aserracorp.com)\_ssl

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/9/9fd13e5b38cb8d789555c5b0e1221dca8000f8d3.jpeg)

Step 5: In the **External Identity Provider Connector Settings** page, configure the following information, leave default settings and click **Save & Next**.

- Select method to configure your IdP Connector: Metadata
- Upload a file in the format name .xml: Choose File **PeopleSoftAssaracorp.xml**
- Name: peoplesoft\_aad\_idp\_connector

 ![image_286273.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/4/4498e90171317dc3f03254bc6cbbd28f227e1b70.png)

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/3X/0/8/0887b3bf0fd17866ae3cfd7772b7fdab72c8c18d.jpeg)

Step 6: In the **Pool Properties** page, configure the following information, leave default settings and click **Save & Next**.

- Select a Pool: PeopleSoft\_backend\_pool

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/3X/0/1/016ca2386783f306ec4a0a48b1e1cf3ffb7e51ab.jpeg)

Step 7: In the **Single Sign-On Settings** page, click **Enable Single Sign-On** , and then click on **Show Advanced Settings** , configure the following information, leave default settings and click **Save & Next**.

- **Select Single Sign-On Type:** HTTP header-based
- **Username Source:** session.saml.last.identity
- **SSO Headers**
  - **Header Operation:** replace
  - **Header Name:** PS\_SSO\_UID
  - **Header Value:** %{session.saml.last.attr.name.EMPLID}

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/09e0ce5b11159b1e7d9f53642bd0b1609e0a2bfb.jpeg)

Step 8: In the **Endpoint Checks Properties** page, leave default settings and click **Save & Next**.

Step 9: In the **Timeout Settings** page, leave default settings and click **Save & Next**.

Step 10: In the **Your application is ready to be deployed** page, click **Deploy**.

 ![image_286273.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/3X/3/1/31bc551e8828a59987bceef57fbf818036113301.jpeg)

This completes APM configuration.

## Resources

- [BIG-IP Knowledge Center](https://support.f5.com/csp/knowledge-center/software/BIG-IP?module=BIG-IP%20APM)
- [BIG-IP APM Knowledge Center](https://support.f5.com/csp/knowledge-center/software/BIG-IP?module=BIG-IP%20APM)
- [Configuring Single Sign-On with Access Policy Manager](https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-6-0/21.html)

## Validated Products and Versions

- **BIG-IP APM** 14.1