Forum Discussion

jjarboe01's avatar
jjarboe01
Icon for Nimbostratus rankNimbostratus
Sep 24, 2021

APM using Radius authentication with MFA breaks RDP/Citrix Single Sign-On

Interesting issue discovered (v14). We use Okta for MFA login on an APM policy. Our Okta allows for answering a security question (yes, not TRUE MFA, working to fix that policy), but this also applies if you use a 6 digit code. F5 is overwriting the session.logon.last.password variable with the last input on the Radius step, thus breaking the single-signon to RDP and Citrix.

APM
application delivery

1 Reply

Sort By
  • jjarboe01's avatar
    jjarboe01
    Icon for Nimbostratus rankNimbostratus
    Sep 24, 2021

    So, the answer here is actually simple. Right before the Radius authentication step, create a variable assign step, and set a variable called "session.original.last.password" to the value of the Session Variable "session.logon.last.password". Then, after the Radius step in the policy, do the reverse of this to reset the session.logon.last.password value from session.original.last.password. This way, you don't have to change every Citrix and RDP object in the policy to use another variable.