Forum Discussion

Roo_150490's avatar
Roo_150490
Icon for Nimbostratus rankNimbostratus
Jun 19, 2014

Passing user credentials to APM

Hello everyone,

 

I was wondering if there is a way to pass user credentials to my f5 apm automatically from a user that is logged onto our domain. For example if I have a user that Is logged into his machine and my f5 apm is authenticating that user against ACtive Directory, then Is there any way I can browse to the f5 apm login page and it seemlessly logs me in and presents me with the applications I have available to me, as I have already logged into the domain by logging in on the machine?

 

Or for example if I have an intranet site hosted on sharepoint for example that is authenticated using ntlm, then sharepoint already knows who I am... So when I click a link that points to my f5 apm portal off of my intranet the f5 will already know who I am because sharepoint has already authenticated me, and present me with my dynamic list of applications?

 

APM
design
microsoft
security

6 Replies

Sort By
  • Roo_150490's avatar
    Roo_150490
    Icon for Nimbostratus rankNimbostratus
    Jun 19, 2014

    Thanks for the response... So would this still pass credentials onto applications on my webtop that use authentication methods such as saml backed off to the same AD, ntlm and those applications that don't support any type of sso, just load up their respective login pages?

     

    I have tried reading the Kerberos parts previously... And am still confused hence trying to work backwards from what I would want an end user to experience to ascertain whether the apm could do this for me for starters.

     

  • EmBee_57573's avatar
    EmBee_57573
    Icon for Nimbostratus rankNimbostratus
    Jun 19, 2014

    Of you Use kerberos delegation, The f5 Will Will get an Ad account with delegation richts. IT Will spend The username back to the sharepoint server, but not with pw credentials. You could try to get all Apps om kerberos.

     

  • EmBee_57573's avatar
    EmBee_57573
    Icon for Nimbostratus rankNimbostratus
    Jun 19, 2014

    You should Point your users to start at The APM. There they login and go from There. You need to cache The users credentials which you Will not be able to extract from Any cookie or token ( that would be a security breach)

     

  • Matt_Dierick's avatar
    Matt_Dierick
    Icon for Employee rankEmployee
    Jun 19, 2014

    Hi Roo,

     

    If I understand your use case, it's for an internal usage only. No internet publishing ? Correct ?

     

    Regarding your fist request, APM uses kerberos or NTML authentication for that. If your laptop and you are in the domain, the APM policy will request the windows authentication to the laptop and you will be authenticate to the APM seamlessly. And you will see your application on the webtop. You can enable SSO for these apps as well (https://devcentral.f5.com/articles/apm-cookbook-single-sign-on-sso-using-kerberos).

     

    Regarding your second request. More challenging. APM does not have any connector with your application regarding session opened. So, if the user already has a Sharepoint session opened, APM is not aware of, so APM will present the authentication (logon page, 401 ...). But if kerberos or NTLM auth is enabled on APM, it should be seamless for the user.

     

  • Roo_150490's avatar
    Roo_150490
    Icon for Nimbostratus rankNimbostratus
    Jun 20, 2014

    Hi Matthieu,

     

    Yes, you have understood correctly... when my users are internal and logged into their domain machines, I would like for them to be able to browse to the APM Portal Page, and not be prompted for a login again, as they have already logged into my domain and the same credentials would be passed to the APM if they where to login manually. So for example, log into the domain joined machine, browse to APM Portal Page, it goes straight through without credential prompt and presents the users with his specific list of applications that the APM will generate and present to that user.

     

    You say:

     

    "Regarding your fist request, APM uses kerberos or NTML authentication for that"

     

    Can you help me understand how I can get this working so the login page doesnt present me with a credential box, and sends me straight onto my webtop, that is generated based on the user coming in (i.e. different users will get different application icons)

     

    From External , I would expect all users to authenticate, regardless...