on 20-Jun-2014 08:07
From time to time I receive requests on how to make APM authenticate against multiple domains. These organizations require unique domains for various user roles such as contractor versus employee or student versus faculty. There are several ways to achieve this depending upon the required user interaction - manual versus automated.
In this series we will work through a few ways APM can help your achieve this requirement:
For part 1 we’ll take a look at placing a domain drop down list on the APM logon page. This topic has previously been covered by Jason Rahm on DevCentral but required advanced APM knowledge and heavy modifications of underlying code. In BIG-IP TMOS version 11.5 additional login page input types were added: select and checkbox.
With the addition of these new input types F5 has significantly reduced the complexity of implementing this solution.
In this example I assume you already have an APM Access Policy created and we will modify it to add the domain drop down feature.
Type | select |
Post Variable Name | domain |
Session Variable Name | domain |
Values | In the pop-up window add values for Contractor and Employee (see image below) |
Logon Page Input Field #3 | Domain |
Now that we’ve customized the Logon Page we need to add logic to our Visual Policy Editor to choose the correct domain based upon which domain was selected.
expr { [mcget {session.logon.last.domain} ] eq “Contractor” }
With the logon Page customized and the Check Domain decision box complete now you can add multiple AD Authentication (or any other authentication types) to your Visual Policy Editor. The image blow provides an example of a completed VPE.
End Results
The final result will provide a Domain drop down box on the APM logon page allowing users to select which domain they belong to. Pretty easy!
In the next post we’ll add additional logic to select the correct domain without requiring the drop down box
You can find the 2nd part here - https://f5guru.com/2014/11/17/apm-cookbook-multiple-domain-authentication-part-2/ I'm still having issues with this setup, syntax appears to be OK but sessions fail and report shows this logic just skips past the two domains I have setup to failback and deny.
Excelent article!!!
I used it to do O365 and multiple domains integrations. It´s working very well.
Well done!!!
@col_h did you ever find a solution to the logic skipping past the domains? I'm having the same thing. It is being evaluated but the domain is just being skipped past.