Manual Chapter :
Configuring AAA Servers in APM
Applies To:
Show Versions![Show Versions](/etc/designs/pcx/techdocs/images/expandversions.gif)
BIG-IP APM
- 14.0.1, 14.0.0
Configuring AAA Servers in APM
About VMware View and APM authentication types
You can authenticate View Clients in Access Policy Manager (APM®) using the types of authentication that View Clients support:
Active Directory authentication (required) and RSA SecurID authentication (optional).
APM supports these authentication types with AAA servers that you configure in APM.
For more information, refer to
BIG-IP®
Access Policy Manager: Authentication and Single-Sign On
at http://support.f5.com
.Task summary for configuring a AAA Active Directory server object in APM
You need at least one AAA Active Directory server object in APM to support AD
authentication for VMware View. If you also want to collect RSA PINs, you need at least
one AAA SecurID server object in APM.
Configuring an Active
Directory AAA server
You
configure an Active Directory AAA server in Access Policy Manager (APM) to specify domain
controllers for APM to use for authenticating users.
- On the Main tab, click.The Active Directory Servers list screen opens.
- ClickCreate.The New Server properties screen opens.
- In theNamefield, type a unique name for the authentication server.
- In theDomain Namefield, type the name of the Windows domain.
- For theServer Connectionsetting, select one of these options:When configuring an Active Directory AAA server that is located in a nondefault route domain, you must selectUse Pooland specify the pool containing the Active Directory server.
- SelectUse Poolto set up high availability for the AAA server.
- SelectDirectto set up the AAA server for standalone functionality.
- If you selectedDirect, type a name in theDomain Controllerfield.
- If you selectedUse Pool, configure the pool:
- Type a name in theDomain Controller Pool Namefield.
- Specify theDomain Controllersin the pool by typing the IP address and host name for each, and clicking theAddbutton.
- To monitor the health of the AAA server, you have the option of selecting a health monitor: only thegateway_icmpmonitor is appropriate in this case; you can select it from theServer Pool Monitorlist.
- In theAdmin Namefield, type a case-sensitive name for an administrator who has Active Directory administrative permissions.An administrator name and password are required for an AD Query access policy item to succeed when it includes particular options. Credentials are required when a query includes an option to fetch a primary group (or nested groups), to prompt a user to change password, or to perform a complexity check for password reset.
- In theAdmin Passwordfield, type the administrator password associated with the Domain Name.
- In theVerify Admin Passwordfield, retype the administrator password associated with theDomain Namesetting.
- In theGroup Cache Lifetimefield, type the number of days.The default lifetime is 30 days.
- In thePassword Security Object Cache Lifetimefield, type the number of days.The default lifetime is 30 days.
- From theKerberos Preauthentication Encryption Typelist, select an encryption type.The default isNone. If you specify an encryption type, the BIG-IP system includes Kerberos preauthentication data within the first authentication service request (AS-REQ) packet.
- In theTimeoutfield, accept the default value or type a number of seconds.The timeout specifies the number of seconds to reach the AAA Active Directory server initially. After the connection is made, the timeout for subsequent operations against the AAA Active Directory server is 180 seconds and is not configurable.
- ClickFinished.The new server displays on the list.
This
adds the new Active Directory server to the Active Directory Servers list.
Configuring a SecurID
AAA server in APM
Configure a SecurID AAA server for Access Policy Manager (APM) to request RSA SecurID
authentication from an RSA Manager authentication server.
- On the Main tab, click.The Authentication screen opens.
- On the menu bar, clickAAA Servers By Type, and selectSecurID.The SecurID screen opens and displays the servers list.
- ClickCreate.The New Server properties screen opens.
- In theNamefield, type a unique name for the authentication server.
- In the Configuration area, for theAgent Host IP Address (must match the IP address in SecurID Configuration File)setting, select an option as appropriate:
- Select from Self IP List: Choose this when there is no NAT device between APM and the RSA Authentication Manager. Select an IP from the list of those configured on the BIG-IP system (in the Network area of the Configuration utility).
- Other: Choose this when there is a NAT device in the network path between Access Policy Manager and the RSA Authentication Manager server. If selected, type the address as translated by the NAT device.
This setting does not change the source IP address of the packets that are sent to the RSA SecurID server. (Layer 3 source addresses remain unchanged.) The agent host IP address is used only in Layer 7 (application layer) information that is sent to the RSA SecurID server. - For theSecurID Configuration Filesetting, browse to upload thesdconf.recfile.Consult your RSA Authentication Manager administrator to generate this file for you.
- ClickFinished.The new server displays on the list.
This
adds a new RSA SecurID server to the AAA Servers list.