Seamless SSO: Azure with SAML and MFA

Seamless SSO: Azure with SAML and MFA

• Overview of Azure with SAML for Seamless SSO and MFA

• Creating an external IdP connector for standard authentication with Azure AD

• Creating an external IdP connector for MFA with Azure AD

• Creating a local Service Provider for primary authentication with Azure AD

• Creating a local Service Provider for MFA with Azure AD

• Creating an allow-all per-session policy

• Creating the per-request policy for Azure AD with SAML and MFA

• Adding a URL branching rule

• Adding subroutines for SAML Auth with and without MFA

• Creating a virtual server for SAML Auth with Azure and MFA

Overview of Azure with SAML for Seamless SSO and MFA

What happens in this scenario

In this scenario:

• The Microsoft identity platform is used for main authentication and for multi-factor authentication as the Identity Provider (IdP).

• The BIG-IP that outsources authentication to the Microsoft identity platform is registered in Azure Active Directory (Azure AD) as an application with the SAML (Security Assertion Markup Language) SSO method.

• The app (named App) is behind a BIG-IP and all the requests to the application come through a BIG-IP LTM virtual server.

• When a user attempts to access the administrative console of App, multi-factor authentication is required.

• All access policy actions occur in a per-request Policy, using subroutines. The main access policy exists only to create a container for the per-request policy.

• Because the configuration occurs in a per-request Policy and subroutines, continuous client checks are possible, and occur on a periodic basis. The per-request policy also allows revalidation of the access policy items based on changing information, or, in this case, a request for a new URL.

• Prerequisite items to configure in Azure AD

Prerequisite items to configure in Azure AD

Prerequisites to configure

Note: Because the configuration for items on non-F5 products can change, we provide only the details of what needs to be configured, and not the procedures for configuring those items.

In the Microsoft Azure portal, configure the items listed.

• Create a basic SAML configuration for the first application, which requires only normal authentication:
  • Entity ID: this is the unique identifier of the entity. The entity is an immutable name for the entity, which is also the unique identifier of the service provider. This value must match the Entity ID of the SAML Service Provider configured on the BIG-IP. For example, https://app.example.com/.
  • Reply URL (Assertion Consumer Service URL): The address (based on the app address) <app-address>/saml/sp/profile/post/acs. For example, https://app.example.com/saml/sp/profile/post/acs.
• Download the Azure STS Metadata for the application after you have created it. In the SAML Signing Certificate area, next to Federation Metadata XML, click Download.
• Assign users and groups to the application, using the Users and Groups panel in Azure.
• Create a basic SAML configuration for the second application, which requires MFA:
  • Entity ID: this is a URI, and matches the BIG-IP virtual server address for the application. For example, https://app.example.com/admin/.
  • Reply URL (Assertion Consumer Service URL): The address (based on the app address) <app-address>/saml/sp/profile/post/acs. Note that this address should be the same as the address for the previous application. For example, https://app.example.com/saml/sp/profile/post/acs.
• Download the Azure STS Metadata for the application after you have created it. In the SAML Signing Certificate area, next to Federation Metadata XML, click Download.
• Assign users and groups to the application, using the Users and Groups panel in Azure. The users and groups you configure for this application should be the same as the users and groups you configure for the first application. Only the Conditional Access policy should change.
• Create a Conditional Access policy for the app that configures multifactor authentication. This policy should include:
  • The policy must specify the cloud app to which the policy applies (for example, the https://app.example.com/admin/ policy specified above).
  • The policy must specify the users and groups to which the policy applies.
  • The policy must require multifactor authentication.

Creating an external IdP connector for standard authentication with Azure AD

Locate the metadata you exported from Azure AD for the non-gallery application you created for standard authentication. You will use this metadata to create the external IdP on the BIG-IP.

You create an external IdP to allow BIG-IP to work as a Service Provider with Azure AD as the Identity Provider.

1. On the Main tab, click Access > Federation > SAML Service Provider > External IdP Connectors.

2. Click the arrow next to Create, then select From Metadata.

3. Click Browse and select the metadata file you exported from Azure AD for the application with main authentication.

4. Type a Name for the Identity Provider.

5. Click OK.

Next, create the external IdP connector for multifactor authentication.

Creating an external IdP connector for MFA with Azure AD

Locate the metadata you exported from Azure AD for the non-gallery application you created for multifactor authentication. You will use this metadata to create the external IdP on the BIG-IP.

You create an external IdP to allow BIG-IP to work as a Service Provider with Azure AD as the Identity Provider.

1. On the Main tab, click Access > Federation > SAML Service Provider > External IdP Connectors.

2. Click the arrow next to Create, then select From Metadata.

3. Click Browse and select the metadata file you exported from Azure AD for the application with MFA.

4. Type a Name for the Identity Provider.

5. Click OK.

Next, create local SAML Service Providers (SPs) for the main authentication and multifactor authentication.

Creating a local Service Provider for primary authentication with Azure AD

Create the local service provider to provide the authentication object that you can reference in the SAML Auth item in the per-request policy.

1. On the Main tab, click Access > Federation > SAML Service Provider > Local SP Services.

2. Click Create.

3. Specify the app URI for the Entity ID.

   For example, https://app.example.com/.

4. Select the Scheme, and specify the Host URL.

   For example, app.example.com.

5. Click Security Settings.

6. Select Sign Authentication Request and select the Message Signing Private Key and Message Signing Certificate.

7. Click Advanced.

8. Select Allow Name-Identifier Creation.

9. From the list, select urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.

10. Click OK.

11. Click Bind/Unbind IdP Connectors.

12. Click Add New Row.

13. Select the IdP connector you created for the non-MFA application.

14. Click Update, then click OK.

Creating a local Service Provider for MFA with Azure AD

Create the local service provider to provide the authentication object that you can reference for MFA in the SAML Auth item in the per-request policy.

1. On the Main tab, click Access > Federation > SAML Service Provider > Local SP Services.

2. Click Create.

3. Specify the app URI for the Entity ID for which you specified MFA on Azure.

   For example, https://app.example.com/admin/.

4. Select the Scheme, and specify the Host URL.

   For example, app.example.com.

   Note: The Host field should contain the same URL as the non-MFA Service Provider.

5. Click Security Settings.

6. Select Sign Authentication Request and select the Message Signing Private Key and Message Signing Certificate.

7. Click Advanced.

8. Select Allow Name-Identifier Creation.

9. From the list, select urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.

10. Click OK.

11. Click Bind/Unbind IdP Connectors.

12. Click Add New Row.

13. Select the IdP connector you created for the MFA application.

14. Click Update, then click OK.

Creating an allow-all per-session policy

You create an allow-all per-session policy to provide an in and out point for your per-request policies on a virtual server.

Note: It is not required that the per-session policy that provides the in and out point for your per-request policy be empty. You can use an existing policy, or create one with per-session access policy items specifically for this purpose. However, an allow-all policy is the simplest per-session policy that will work.

1. On the Main tab, click Access > Profiles / Policies > Access Profiles (Per-Session Policies).

2. Click Create.

3. Name the access policy (for example, allow-all).

4. For the Profile Type, select All.

5. In the Language Settings section, move one or more languages to the Accepted Languages list.

6. Click Finished.

   The Access Profiles (Per-Session Policies) screen is displayed.

7. In the Per-Session Policies column, click the Edit… link.

8. Change the Deny ending to Allow.

9. Save and Apply the access policy.

You now have a per-session access policy that allows all traffic, which can then be processed by the per-request access policy.

Create a virtual server for the HTTP Connector policy.

Creating the per-request policy for Azure AD with SAML and MFA

You should have created applications on your Azure AD system for main authentication and MFA. On the BIG-IP, you should have configured External Identity Providers and local Service Providers for both main authentication and MFA.

In this task, you configure the access policy that creates the traffic and event flow for the BIG-IP as a Service Provider and Azure AD as the Identitity Provider, using SAML Authentication and MFA for separate per-request policy branches.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies.

2. Click Create.

3. Specify a Name and add one or more Accepted Languages.

4. Click Finished.

Adding a URL branching rule

You must have a per-request policy.

Add a URL branching rule to provide branching for different URLs to allow different authentication methods.

1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

3. Add a URL branching rule by clicking the plus symbol, then the Classification tab, then selecting URL Branching. Click Add Item.

4. Click the Branch Rules tab.

5. In the Name field, type the name of the branch for MFA. For example, admin.

6. Next to Expression: URL contains: domain.com, click Change.

7. In the URL contains field, type the URL for users who are required to use MFA. For example, https://app.example.com/admin/*.

   Important: Rules are evaluated in order, so specify the most specific rule first. In this example, we specify the <url>/admin/* rule first, because this URL requires MFA, and it is more specific than the next rule, <url>/*. If we specified the less specific rule first, all traffic would be sent to primary authentication, and MFA would not be used.

8. Click Finished.

9. From Insert Before, select fallback, then click Add Branch Rule.

10. In the Name field, type the name of the branch that does not use MFA. For example, non-admin.

11. Next to Expression: Empty click change.

12. Click Add Expression.

13. From Condition, select Substring.

14. In the URL contains field, type the URL to match for all other non-MFA traffic. For example, https://app.example.com/*.

    Tip: You are not required to use substring as the condition when specifying a URL. You can use equals for an exact match, prefix or suffix for prefix or suffix matching, or glob for glob matching.

15. Click Finished.

    This is an example of the URL Branching access policy item configured to branch for MFA and non-MFA authentication.

    

Adding subroutines for SAML Auth with and without MFA

You should have a per-request policy, and SAML authentication servers for authentication with and without MFA.

Create the subroutines to allow continuous checks and reauthenticate with SAML and MFA when the user goes to a specific URL.

1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

3. In the per-request policy, click Add New Subroutine.

4. Name the subroutine for use with SAML Auth and MFA. For example, APP Azure SAML Auth + MFA.

5. Click Save.

6. Expand the subroutine, and click the plus to add a new item.

7. Click the Authentication tab, select SAML Auth, and click Add Item.

8. Select the AAA Server for SAML Authentication with MFA. For example, /Common/app.example.com-azure-mfa.

9. Click Save.

10. In the subroutine, click Edit Terminals.

11. Click Add Terminal.

12. Select the red color for the new terminal, and name the unsuccessful terminal, for example, fail.

    Restriction: You cannot name the failure terminal fallback.

13. Create another subroutine for SAML Auth without MFA, name it accordingly, and for the AAA Server, select the non-MFA AAA server.

    Configure the terminals in the same way.

14. On the MFA branch of the per-request policy, click the plus symbol.

15. Click the Subroutines tab, select the SAML Auth with MFA subroutine you created, and click Add Item.

16. On the non-MFA branch of the per-request policy, click the plus symbol.

17. Click the Subroutines tab, select the SAML Auth without MFA subroutine you created, and click Add Item.

18. Add any other items your per-request policy requires.

    This example shows a completed per-request policy with MFA and non-MFA subroutines, assigned by URL branching. A Pool Assign macro has also been added, which assigns a static pool after authentication succeeds. The Start of the policy has been removed for image clarity.

    

The per-request policy is now configured.

Configure a virtual server for the application, and attach the allow-all access policy and the authentication per-request policy.

Creating a virtual server for SAML Auth with Azure and MFA

Determine the IP address you want to use to create the virtual server. This should be the same address as your application. For example, app.example.com.

Create a virtual server and attach the allow-all access policy and the per-request policy that confgures SAML Auth with Azure and MFA.

1. On the Main tab, click Local Traffic > Virtual Servers.

   The Virtual Server List screen opens.

2. Click Create.

   The New Virtual Server screen opens.

3. In the Name field, type a unique name for the virtual server.

4. In the Destination Address field, type the IP address you want to use for the virtual server.

   This address should correspond to the address specified for your application in Microsoft Azure.

5. In the service port field, type the service port, or select the service from the list.

   For example, HTTPS.

6. From HTTP Profile (Client) select an HTTP profile (typically, http).

7. In the Access Policy area, from Access Profile, select the allow-all access policy you created.

8. From Per-Request Policy, select the per-request policy you created for SAML Auth with Azure and MFA.

9. Click Finished.

You have completed configuration for SAML Auth with Azure and MFA.