Manual Chapter : Hosting a BIG-IP Edge Client Download with Access Policy Manager
Applies To:Show Versions
- 16.0.1, 16.0.0
Hosting a BIG-IP Edge Client Download with Access Policy Manager
About hosting a BIG-IP
Edge Client file on Access Policy Manager
You can host files on BIG-IP Access Policy Manager (APM) so clients can download them.
When you host a file on Access Policy Manager, you can provide the link to the file in a number of ways. In this example, the BIG-IP Edge Client for Mac link is provided as a link on the user's webtop. The user connects through the web client, then clicks a link on the webtop to download the client file. To provide the BIG-IP Edge Client for Mac, first you must create a connectivity profile. Then, you can download the Mac client file as a ZIP file.
Configuring a connectivity profile for Edge Client for
Update the connectivity profile in your Network Access configuration to configure security settings, servers, and location-awareness for BIG-IP Edge Client for macOS.
- On the Main tab, click.A list of connectivity profiles displays.
- Select the connectivity profile that you want to update and clickEdit Profile.The Edit Connectivity Profile popup screen opens and displays General Settings.
- From the left pane of the popup screen, selectWin/Mac Edge Client.Edge Client settings for Mac and Windows-based systems display in the right pane.
- Retain the default (selected) or clear theSave Servers Upon Exitcheck box.Specifies whether Edge Client maintains a list of recently used user-entered APM servers. Edge Client always lists the servers that are defined in the connectivity profile, and sorts them by most recent access, whether this option is selected or not.
- To enable the client to launch an administrator-defined script on session termination, selectRun session log off scriptcheck box. The administrator specifies parameters which are passed by Edge Client to the script file. These parameters are defined by the session variablesession.edgeclient.scripting.logoff.params. The client retrieves parameters from BIG-IP after session establishment. The administrator has the flexibility to set up variable values according to policy branching. Each time the Edge Client closes an APM session, the configured script is invoked. On macOS, the script is located at/Library/Application Support/F5Networks/EdgeClient/Scripting/onSessionTermination.bat.TheRun session log off scriptcheck box is cleared by default.
- To enable the client to display a warning before launching the pre-defined script on session termination, selectShow warning to user before launching scriptcheck box.This is selected by default.
- To support automatic reconnection without the need to provide credentials again, allow password caching.
- Select theAllow Password Cachingcheck box.This check box is cleared by default.The remaining settings on the screen become available.
- From theSave Password Methodlist, selectdiskormemory.If you selectdisk, Edge Client caches the user's password (in encrypted form) securely on the disk where it is persisted even after the system is restarted or Edge Client is restarted.If you selectmemory, Edge Client caches the user's password within the BIG-IP Edge Client application for automatic reconnection purposes.If you selectmemory, thePassword Cache Expiration (minutes)field displays with a default value of 240.
- If thePassword Cache Expiration (minutes)field displays, retain the default value or type the number of minutes to save the password in memory.
- To enable automatic download and update of client packages, from theComponent Updatelist, selectyes(default).If you selectyes, APM updates Edge Client software automatically on the client system when newer versions are available. This option applies to updates for these components only: BIG-IP Edge Client, component installer service, DNS relay proxy service, and user logon credentials access service.
- Beginning BIG-IP version 16.0.0, connectivity profile has optionalOAuth Settingsthat Edge Client will use for authenticating Native Apps using OpenID Connect specification. When OAuth is configured, the end-users are required to authenticate via the OAuth authentication flow. This OIDC support provides consistent authentication experience by enabling two-factor verification and Single Sign-On across Browser and Edge Client.For security reasons, when configuring for OAuth settings, ensure that the BIG-IP local traffic policy enforces HTTPS by redirecting HTTP requests to HTTPS for a virtual server on the BIG-IP system. Refer OIDC RFC for details on OAuth 2.0 Authorization Framework.
Refer sectionConfiguring policies for OAuth client and resource serverin theBIG-IP Access Policy Manager: OAuth Concepts and Configurationfor details on adding an OAuth Resource Server to the access policy.
- From the left pane of the popup screen, selectOAuth Settings.
- Select the OAuth provider in theProviderlist. If you selectNone, OAuth configuration is disabled.
- Specify the OAuth Client ID identifier in theClient IDfield. The client identifier is not a secret and is exposed by the BIG-IP APM virtual server. OAuth configuration is disabled if client ID is not specified.
- Specify the scopes that will be requested by the client in theScopesfield. The value of the scope parameter is expressed as a list of space-delimited, case-sensitive strings defined by the authorization server. When using multiple strings, the order does not matter. All printable ASCII characters are allowed excluding quote (") and backslash (\).
- In theComplete Redirection URIfield, enter the optional URI for OAuth client to be directed to when authentication completes or fails. The default APM page is used if this URI is not specified. The URI should start with "https://", "http://" or "/".
- Specify the list of APM servers to provide when the client connects.The servers you add here display as connection options in the BIG-IP Edge Client.Users can select from these servers or they can type a hostname.
- From the left pane of the popup screen, selectServer List.A table displays in the right pane.
- ClickAdd.A table row becomes available for update.
- You must type a host name in theHost Namefield.Typing an alias in theAliasfield is optional.
- ClickUpdate.The new row is added at the top of the table.
- Continue to add servers, and when you are done, clickOK.
- Specify DNS suffixes that are in the local network.Providing a list of DNS suffixes for the download package enables Edge Client to support the autoconnect option. WithAuto-Connectselected, Edge Client uses the DNS suffixes to automatically connect when a client is not on the local network (not on the list) and automatically disconnect when the client is on the local network.
- From the left pane of the popup screen, selectLocation DNS List.Location DNS list information is displayed in the right pane.
- ClickAdd.An update row becomes available.
- Type a name and clickUpdate.Type a DNS suffix that conforms to the rules specified for the local network.The new row displays at the top of the table.
- Continue to add DNS names and when you are done, clickOK.
- ClickOK.The popup screen closes, and the Connectivity Profile List displays.
Downloading the ZIP file for Edge Client for Mac
You can download a Mac Client package and distribute it to clients.
- On the Main tab, click.A list of connectivity profiles displays.
- Select a connectivity profile.
- Click the arrow on theCustomize Packagebutton and selectMac.The Customize Mac Client Package screen displays.
- ClickDownload.The screen closes and the package,BIGIPMacEdgeClient.zip, downloads.
The ZIP file includes a Mac installer package (PKG) file and configuration settings.
Uploading BIG-IP Edge Client to hosted content on Access Policy Manager
Upload the client file to the Access Policy Manager hosted content repository so you can provide it to clients through a download link.
- On the Main tab, click.The Manage Files screen opens.
- Click theUploadbutton.The Create New File popup screen opens.
- For theSelect Filesetting, click theBrowsebutton. Browse and select theBIGIPMacEdgeClient.zipfile that you previously downloaded.TheSelect FileandFile Namefields are populated with the file name.
- From theFile Actionlist, selectUpload Only.
- In theFile Destination Folderfield, specify the folder path in which to place the file. For purposes of this example, the folder/clientis specified.
- ClickOK.The file appears in the hosted content list.
You must associate any access profiles that will access hosted content with the hosted content repository.
Associating hosted content with access profiles
A user can access hosted content that is associated with that user's access profile. Each access profile that requires hosted content access must be associated with the entire hosted content repository.
- On the Main tab, click.The Manage Files screen opens.
- On theUploadbutton, click the right-side arrow to selectManage Accessfrom the list.The Access Settings popup screen opens.
- Select the access profiles to associate with hosted content, then clickOK.A user must belong to an associated access profile to access hosted content.
View the hosted content list and verify that the access policy association was successful.
Creating a webtop link for the client installer
You can create and customize links that you can assign to full webtops. In this context,
linksare defined applications and web sites that appear on a webtop, and can be clicked to open a web page or application. You can customize these links with descriptions and icons.
- On the Main tab, click.
- ClickCreate.The New Webtop Link screen opens.
- In theNamefield, type a name for the webtop.
- From theLink Typelist, selectHosted Content.
- From theHosted Filelink, selectpublic/share/client/BIGIPMacEdgeClient.zip.
- In theCaptionfield, type a descriptive caption.TheCaptionfield is pre-populated with the text from theNamefield. Type the link text that you want to appear on the web link.
- If you want to add a detailed description, type it in theDetailed Descriptionfield.
- To specify an icon image for the item on the webtop, click in theImagefield and choose an image, or click theBrowsebutton.Click theView/Hidelink to show or hide the currently selected image.
The webtop link is now configured, and appears in the list, and on a full webtop assigned with the same action. You can edit the webtop link further, or assign it to an access policy.
Before you can use this webtop link, it must be assigned to an access policy with a full webtop, using either an advanced resource assign action or a webtop,links and sections assign action.
Add a webtop,
links, and sections to an access policy
You must have an access profile set up before you can add a webtop, links, and sections to an access policy.
You can add an action to an access policy to add a webtop, webtop links, and webtop sections to an access policy branch. Webtop links and webtop sections are displayed on a full webtop.
Do not assign a webtop for a portal access connection configured for minimal patching mode; this configuration does not work.
- On the Main tab, click.The Access Profiles (Per-Session Policies) screen opens.
- Click the name of the access profile for which you want to edit the access policy.The properties screen opens for the profile you want to edit.
- On the menu bar, clickAccess Policy.
- In the General Properties area, click theEdit Access Policy for Profilelink.profile_nameThe visual policy editor opens the access policy in a separate screen.
- On a policy branch, click the(+)icon to add an item to the policy.A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
- On the Assignment tab, select theWebtop, Links and Sections Assignagent and clickAdd Item.The Webtop, Links and Sections Assignment screen opens.
- In theNamefield, type a name for the policy item.This name is displayed in the action field for the policy.
- For each type of resource that you want assign:
- Click theAdd/Deletelink next to the resource type (Webtop Links,Webtop Sections, orWebtop).Available resources are listed.
- Select from the list of available resources.Select only one webtop.
- Click theSavebutton to save changes to the access policy item.
You can now configure further actions on the successful and fallback rule branches of this access policy item.
Apply Access Policylink to apply and activate your changes to this access policy.
To ensure that logging is configured to meet your requirements, verify the log settings for the access profile.