Manual Chapter : Single Sign-On Methods

Applies To:

  • BIG-IP APM

    15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0

Updated Date: 07/07/2026

Single Sign-On Methods

Access Policy Manager provides a Single Sign-On (SSO) feature that leverages the credential caching and credential proxying technology.

Credential caching and proxying is a two-phase security approach that asks users to enter their credentials once to access their secured web applications. By leveraging this technology, users request access to the secured back-end web server. After that occurs, Access Policy Manager creates a user session and collects the user identity based on the access policy. When the access policy completes successfully, the user identity is saved (cached) in a session database. Access Policy Manager subsequently reuses the cached identity to seamlessly log the user into the secured web applications, thus providing the user with a single sign-on experience.

The Single Sign-On (SSO) feature provides the following benefits:

  • Eliminates the need to administer and maintain multiple user logins
  • Eliminates the need for users to enter their credentials multiple times.

Access Policy Manager supports the following SSO authentication methods.

SSO method Description
HTTP Basic Access Policy Manager uses the cached user identity and sends the request with the authorization header. This header contains the token Basic and the base64-encoded for the user name, colon, and the password.
NTLMV1 NTLM version 1 employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to the server.
NTLMV2 NTLM version 2 employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to the server. This version of NTLM is an updated version from NTLM v1.
Kerberos This provides transparent authentication of users to Windows Web application servers (IIS) joined to Active Directory domain. It is used when IIS servers request Kerberos authentication; this SSO mechanism allows the user to get a Kerberos ticket and have Access Policy Manager present it transparently to the IIS application.
Form Based Upon detection of the start URL match, Access Policy Manager uses the cached user identity to construct and send the HTTP form-based post request on behalf of the user.
Forms - Client Initiated Upon detection of the request for logon page (URI, header, or cookie that is configured for matching the request), Access Policy Manager generates JavaScript code, inserts it into the logon page and returns the logon page to the client, where it is automatically submitted by inserted JavaScript. APM processes the submission and uses the cached user identity to construct and send the HTTP form-based post request on behalf of the user.
OAuth Bearer The OAuth Bearer provides an access token to the backend server. You can configure OAuth single sign-on as passthrough (where the JWT token is received by other means) or have APM generate and sign the token.
SAML A SAML IdP service is a type of single sign-on (SSO) authentication service in APM that provides SSO authentication for external SAML service providers (SPs). You specify a SAML IdP service when you use a BIG-IP system as a SAML identity provider (IdP). Configure SAML under Federation.

Access Policy Manager supports various SSO configurations. Each configuration contains a number of attributes that you need to specify correctly to support SSO.

Misconfiguring SSO objects for HTTP Basic, NTLM v1 and v2, Kerberos, and OAuth Bearer could disable SSO for all authentication methods in a user’s session when the user accesses a resource using the misconfigured SSO configuration. The exceptions are Forms and Forms - Client Initiated; these are the only SSO methods that are not disabled when any other method fails due to a misconfigured SSO object.

With the HTTP Basic method of authentication, the SSO plug-in uses the cached user identity and sends the request with the authorization header. This header contains the Basic token and the base64-encoding of the user name, colon, and the password.

  1. On the Main tab, click Access > Single Sign-On > HTTP Basic.

    The HTTP Basic screen opens.

  2. Click Create.

    The New SSO Configuration screen opens.

  3. In the Name field, type a name for the SSO configuration.

    The maximum length of a single sign-on configuration is 225 characters, including the partition name.

  4. From the Log Setting list, select one of the following options:

    • Select an existing APM log setting.
    • Click Create to create a new log setting.

  5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.

  6. In the SSO Method Configuration area, specify the relevant settings.

  7. Click Finished.

These settings are available when you create an HTTP Basic SSO configuration.

Setting Value Additional Information
General Properties Basic or Advanced. Defaults to Basic. Additional settings are available when you select Advanced.
Name Name of the SSO configuration. The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Maximum length including the partition name is 225 characters. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
Headers Header name-value pairs to send with the SSO method. Available when you select Advanced from the General Properties list.

Setting Value Additional Information
Username Source Specifies the user name to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.username
Password Source Specifies the password to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.password

Setting Value Additional Information
Username Conversion This check box is clear by default. Select the check box to convert the PREWIN2k/UPN user name input format to the format you want to use for SSO. For example, convert domain\username or username@domain to username.

With the HTTP forms method of authentication, upon detection of the start URL match, the SSO plug-in uses the cached user identity to construct and send the HTTP form-based POST request on behalf of the user.

  1. On the Main tab, select Access > Single Sign-On > Form Based.

    The Form Based screen opens.

  2. Click Create.

    The New SSO Configuration screen opens.

  3. In the Name field, type a name for the SSO configuration.

    The maximum length of a single sign-on configuration is 225 characters, including the partition name.

  4. From the Use SSO Template list, select the template you want to use.

    The screen refreshes to show additional settings applicable to the specific template.

  5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.

  6. If you selected None from theUse SSO Template list, fill in the relevant settings in the SSO Method Configuration area.

    Otherwise, these settings are taken from the template that you selected.

  7. From the Log Setting list, select one of the following options:

    • Select an existing APM log setting.
    • Click Create to create a new log setting.

  8. Click Finished.

These settings are available when you create an HTTP form-based SSO configuration.

Setting Value Additional Information
General Properties Basicor Advanced. Defaults to Basic. Additional settings are available when you select Advanced.
Name Name of the SSO configuration. The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Maximum length including the partition name is 225 characters. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
Use SSO Template   If you selectNone, you must fill in the SSO Method Configuration area. Otherwise, the SSO Method Configuration area is not available; settings are configured with data supplied by the template you select.
Headers Header name-value pairs to send with the SSO method. Available when you select Advanced from the General Properties list.

Setting Value Additional Information
Username Source Specifies the user name to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.username
Password Source Specifies the password to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.password

Setting

Value

Additional Information

Destination (IP or Hostname)

Defines the IP address or fully qualified domain name for the OWA server.

Displays only when you select an SSO template for OWA.

Start URI

Defines the start URI value. HTTP form-based authentication executes for SSO if the HTTP request URI matches the start URI value.

Multiple start URI values in multiple lines can be entered for this attribute. Supported session variable: start_uri

Pass Through

If you select the Enable check box, cookies presented in the form propagate to the client browser. Defaults to cleared.

Form Method

Defines the SSO authentication method : GET or POST. Defaults to POST.

If you specify GET, the SSO authentication method is an HTTP GET request.

Form Action

Defines the form action URL used for HTTP authentication request for SSO.

For example, /access/oblix/apps/webgate/bin/webgate.dll. If left blank, the original request URL is used for SSO authentication.Supported session variable: form_action

Form Parameter For User Name

Defines the parameter name of the logon user name.

For example, the user ID is specified as the attribute value if the HTTP server expects the user name in the form of userid=. Supported session variable: form_parameter

Form Parameter for Password

Defines the name of the logon password.

For example, Pass is specified as the attribute value if the HTTP server expects the password in the form of Pass.

Hidden Form Parameters/Values

Defines the hidden form parameters required by the authentication server logon form at your location.

Specify a parameter name, a space, and the parameter value, if any. Each parameter must start on a new line. This example includes parameters for platform and language.``` platform %{session.client.platform} language American English


 **Note:** When using a session variable as a value, precede it with a percent \(%\) sign and enclose it in curly braces \(\{\}\).

</td></tr><tr id="GUID-7A5AD19C-BB00-493A-905F-88F6F8010178"><td>

**Successful Logon Detection Match Type**

</td><td>

Defines how Access Policy Manager detects whether the user was successfully authenticated by the server. Defaults to **None**. You can select one option.

</td><td>

-   **None** No check is made for authentication success.
-   **By Resulting Redirect URL** Authentication success is checked for by examining the redirect URL from the HTTP response. Multiple values can be specified for this option.
-   **By Presence Of Specific String in Cookie** Authentication success is checked for by searching for the string in the response.

Supported session variable: **success\_match\_value**

</td></tr><tr id="GUID-7B034A17-0846-440E-87F0-D4BB54E3E528"><td>

**Successful Logon Detection Match Value**

</td><td>

Defines the value for the specific success detection type: the redirect URL or cookie name.

</td><td>

For **By Resulting Redirect URL** , you can specify multiple URLs and the system supports a single instance of the wildcard character \(\*\) in a URL.

</td></tr></tbody>
</table>

## Creating an NTLMV1 SSO configuration {#GUID-D238AC11-0EBD-4F74-8B41-8EBD964C9C16}

The NTLM authentication method employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to a server.

1.  On the Main tab, click **Access** &gt; **Single Sign-On** &gt; **NTLMV1**.

    The NTLMV\` screen opens.

2.  Click **Create**.

    The New SSO Configuration screen opens.

3.  In the **Name** field, type a name for the SSO configuration.

    The maximum length of a single sign-on configuration is 225 characters, including the partition name.

4.  From the **Log Setting** list, select one of the following options:

    -   Select an existing APM log setting.
    -   Click **Create** to create a new log setting.
5.  In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.

6.  In the SSO Method Configuration area, specify the relevant settings.

7.  Click **Finished**.

### NTLMV1 SSO configuration settings {#GUID-AFA33E83-F68C-4B72-AF78-8AAD86AF1854}

These configuration settings are available when you configure an NTLMV1 SSO method.

#### General Properties settings for NTLMV1 SSO configuration {#GUID-6F65D89E-5524-4A57-B3FE-EC9821481531 .section}





















    

  
      

          Setting
          Value
          Additional Information
      

  
  
      

          General Properties
          Basicor Advanced. Defaults to Basic.
          Additional settings are available when you select Advanced.
      

      

          Name
          Name of the SSO configuration.
          The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Maximum length including the partition name is 225 characters. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
      

      

          Headers
          Header name-value pairs to send with the SSO method.
          Displayed when you select Advanced from the General Properties list.
      

  








#### Credentials Source settings for NTLMV1 SSO configuration {#GUID-126E09D6-7271-4C71-9F2F-592E026450E2 .section}





















    

  
      

          Setting
          Value
          Additional Information
      

  
  
      

          Username Source
          Specifies the user name to cache for single sign-on. Defaults to a session variable.
          Supported session variable: session.sso.token.last.username
      

      

          Password Source
          Specifies the password to cache for single sign-on. Defaults to a session variable.
          Supported session variable: session.sso.token.last.password
      

      

          Domain Source
          Specifies the domain to cache for single sign-on. Defaults to a session variable.
          Supported session variable: session.logon.last.domain
      

  








#### SSO configuration settings for NTLMV1 SSO configuration {#GUID-DE46A6FE-47F7-44F7-9EF7-89C4197718AE .section}





















    

  
      

          Setting
          Value
          Additional Information
      

  
  
      

          Username Conversion
          Check box is cleared by default.
          Select the check box to convert the PREWIN2k/UPN user name input format to the format you want to use for SSO. For example, convert domain\username or username@domain to username.
      

      

          NTLM Domain
          Specifies the name of the domain where all users and groups are authenticated.
          Specifies a domain name.
      

  








## Creating an NTLMV2 SSO configuration {#GUID-62C982BE-2F8D-4834-8363-FC1BDB65277D}

With this method of authentication, NTLM employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to a server. This version of NTLM has been updated from version 1.

1.  On the Main tab, click **Access** &gt; **Single Sign-On** &gt; **NTLMV2**.

    The NTLMV2 screen opens.

2.  Click **Create**.

    The New SSO Configuration screen opens.

3.  In the **Name** field, type a name for the SSO configuration.

    The maximum length of a single sign-on configuration is 225 characters, including the partition name.

4.  From the **Log Setting** list, select one of the following options:

    -   Select an existing APM log setting.
    -   Click **Create** to create a new log setting.
5.  In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.

6.  In the SSO Method Configuration area, specify the relevant settings.

7.  Click **Finished**.

### NTLMV2 SSO configuration settings {#GUID-DF0818C0-4055-4FB2-85D0-CB6C0DAD5B6F}

These configuration settings are available when you configure an NTLMV2 SSO method.

#### General Properties settings for NTLMV2 SSO configuration {#GUID-C430EEAA-C879-445F-8DEF-00A5CD436C3F .section}





















    

  
      

          Setting
          Value
          Additional Information
      

  
  
      

          General Properties
          Basic or Advanced. Defaults to Basic.
          Additional settings are available when you select Advanced.
      

      

          Name
          Name of the SSO configuration.
          The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Maximum length including the partition name is 225 characters. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
      

      

          Headers
          Header name-value pairs to send with the SSO method.
          Displayed when you select Advanced from the General Properties list.
      

  








#### Credentials Source settings for NTLMV2 SSO configuration {#GUID-52B2AE7C-35E7-4BFA-8388-F168D44B34D2 .section}





















    

  
      

          Setting
          Value
          Additional Information
      

  
  
      

          Username Source
          Specifies the user name to cache for single sign-on. Defaults to a session variable.
          Supported session variable: session.sso.token.last.username
      

      

          Password Source
          Specifies the password to cache for single sign-on. Defaults to a session variable.
          Supported session variable: session.sso.token.last.password
      

      

          Domain Source
          Specifies the domain to cache for single sign-on. Defaults to a session variable.
          Supported session variable: session.logon.last.domain
      

  








#### SSO configuration settings for NTLMV2 SSO configuration {#GUID-9DAF2C57-1964-4931-8814-D4E404B1AB69 .section}





















    

  
      

          Setting
          Value
          Additional Information
      

  
  
      

          Username Conversion
          Check box is cleared by default.
          Select the check box to convert the PREWIN2k/UPN user name input format to the format you want to use for SSO. For example, convert domain\username or username@domain to username.
      

      

          NTLM Domain
          Specifies the name of the domain where all users and groups are authenticated.
          Specifies a domain name.
      

  








### About NTLMv2 SSO failure for an invalid HTTP 401 response {#GUID-CE661AD1-2804-4F02-B067-BC1C615E5FEA}

If an HTTP 401 response from a server includes more than one `www-authenticate: NTLM` header, NTLMv2 SSO fails. This is expected behavior. An HTTP 401 response should contain only one `www-authenticate: NTLM` header.