Forum Discussion

sfntauth_180479's avatar
sfntauth_180479
Icon for Nimbostratus rankNimbostratus
Dec 18, 2014

Certificate based user authentication to F5 APM

We are in need to test CBA authentication to F5 using PKI tokens. Instead of proving AD username and password, user inserts his token(Having user certificate) to client machine and provides pin to th...
BIG-IP Access Policy Manager (APM)
security
amolari's avatar
amolari
Icon for Cirrus rankCirrus
Dec 18, 2014

F5 will be able to check the user certificate but in no way if it's on a token or not (this "info" is not available at all in the communication). Here it's a PKI policy that helps. You should either have

 

  1. certificates on token are issued by a specific CA (higher assurance): the APM will check only client certs issued by that CA
  2. certificates on token have specific properties: the APM can check this properties (that will require an iRule)

Hopefully you have already deployed you certificates in a way that you can apply either 1) or 2)