Security issue using two different authentication methods with the same ntlm domain (SSO)

Are you using two different polices here? Else are you branching out the authentication schema for the policy evaluation based upon host header/URI? How do you end up in a situation where you would not use two-factor authentication to APM?

Yes, two different policies.

Would branching out based upon host header solve the sso problem? Still, a session cookie obtained logging on to ServerB would sso to ServerA, wouldn't it?

After a look at the session variables I found the following useful: In a two-factor authenticated session the variable

session.securid.last.state

SECURID_AUTH_STATE_ACCESS_ACCEPTED

Good idea?

Regards, Alex

Yes, domain cookie. And I would appreciate that after authenticating with password&token I am also sso'ed to the sites that requires only password.

So, getting physical... I would need some help setting up an irule, as I am a miserable programmer...

The steps of the script would be:

1. detect that there is a request from an existing session
2. verify that

   session.securid.last.state

   has the value

   SECURID_AUTH_STATE_ACCESS_ACCEPTED

   .
3. if yes: let it pass on
4. if no: redirect to apm logon page

This irule would be attached to the virtual server with the securid requirement.

Anybody a draft for a script that I can start from? O:-)

Regards, Alexander

Finally I got the leisure to put together an irule to check for a successful rsa authentication on the critical server and to kill the session in case there is none.

when HTTP_REQUEST {
    set rsastate [ACCESS::session data get "session.securid.last.state"]
    if { $rsastate != "SECURID_AUTH_STATE_ACCESS_ACCEPTED" } {
            ACCESS::session remove
    }   
}

Question: Would it be more efficient to use another event than HTTP_REQUEST?