F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP APM
  4. BIG-IP Access Policy Manager: Authentication and Single Sign-On
  5. Single Sign-On Methods
Manual Chapter : Single Sign-On Methods

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 13.0.1, 13.0.0
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

What are the supported SSO methods?

Access Policy Manager® supports the following SSO authentication methods.

SSO method Description
HTTP Basic Access Policy Manager uses the cached user identity and sends the request with the authorization header. This header contains the token Basic and the base64-encoded for the user name, colon, and the password.
HTTP Forms Upon detection of the start URL match, Access Policy Manager uses the cached user identity to construct and send the HTTP form-based post request on behalf of the user.
HTTP Forms - Client Initiated Upon detection of the request for logon page (URI, header, or cookie that is configured for matching the request), Access Policy Manager generates JavaScript code, inserts it into the logon page and returns the logon page to the client, where it is automatically submitted by inserted JavaScript. APM® processes the submission and uses the cached user identity to construct and send the HTTP form-based post request on behalf of the user.
HTTP NTLM Auth v1 NTLM employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to the server.
HTTP NTLM Auth v2 NTLM employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to the server. This version of NTLM is an updated version from NTLM v1.
Kerberos This provides transparent authentication of users to Windows Web application servers (IIS) joined to Active Directory domain. It is used when IIS servers request Kerberos authentication; this SSO mechanism allows the user to get a Kerberos ticket and have Access Policy Manager present it transparently to the IIS application.
SAML A SAML IdP service is a type of single sign-on (SSO) authentication service in Access Policy Manager that provides SSO authentication for external SAML service providers (SPs). You configure a SAML IdP service when you use a BIG-IP® system as a SAML identity provider (IdP).

About the Single Sign-On configuration object

Access Policy Manager® supports various SSO methods. Each method contains a number of attributes that you need to configure properly to support SSO.

Mis-configuring SSO objects for any of these authentication methods (HTTP Basic, NTLM v1 and v2, and Kerberos) could disable SSO for all authentication methods for a user's session when the user accesses a resource with the mis-configured object. The exceptions are Forms and Forms - Client Initiated, which are the only SSO methods that are not disabled when any other method fails due to a mis-configured SSO object.

Creating an HTTP Basic SSO configuration

With the HTTP Basic method of authentication, the SSO plug-in uses the cached user identity and sends the request with the authorization header. This header contains the Basic token and the base64-encoding of the user name, colon, and the password.
  1. On the Main tab, click Access > Single Sign-On > HTTP Basic .
    The HTTP Basic screen opens.
  2. Click Create.
    The New SSO Configuration screen opens.
  3. In the Name field, type a name for the SSO configuration.
  4. From the Log Setting list, select one of the following options:
    • Select an existing APM log setting.
    • Click Create to create a new log setting.

  6. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.
  7. In the SSO Method Configuration area, specify the relevant settings.
  8. Click Finished.

HTTP Basic SSO configuration settings

These settings are available when you create an HTTP Basic SSO configuration.

General Properties settings for HTTP Basic SSO configuration

Setting Value Additional Information
General Properties Basic or Advanced. Defaults to Basic. Additional settings are available when you select Advanced.
Name Name of the SSO configuration. The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
Headers Header name-value pairs to send with the SSO method. Available when you select Advanced from the General Properties list.

Credentials Source settings for HTTP Basic SSO configuration

Setting Value Additional Information
Username Source Specifies the user name to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.username
Password Source Specifies the password to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.password

SSO configuration settings for HTTP Basic SSO configuration

Setting Value Additional Information
Username Conversion This check box is clear by default. Select the check box to convert the PREWIN2k/UPN user name input format to the format you want to use for SSO. For example, convert domain\username or username@domain to username.

Creating an HTTP forms-based SSO configuration

With the HTTP forms method of authentication, upon detection of the start URL match, the SSO plug-in uses the cached user identity to construct and send the HTTP form-based POST request on behalf of the user.
  1. On the Main tab, select Access > Single Sign-On > Form Based .
    The Form Based screen opens.
  2. Click Create.
    The New SSO Configuration screen opens.
  3. In the Name field, type a name for the SSO configuration.
  4. From the Use SSO Template list, select the template you want to use.
    The screen refreshes to show additional settings applicable to the specific template.
  5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.
  6. If you selected None from the Use SSO Template list, fill in the relevant settings in the SSO Method Configuration area.
    Otherwise, these settings are taken from the template that you selected.

  8. From the Log Setting list, select one of the following options:
    • Select an existing APM log setting.
    • Click Create to create a new log setting.
  9. Click Finished.

HTTP Form SSO configuration settings

These settings are available when you create an HTTP form-based SSO configuration.

General Properties settings for HTTP form-based SSO configuration

Setting Value Additional Information
General Properties Basic or Advanced. Defaults to Basic. Additional settings are available when you select Advanced.
Name Name of the SSO configuration. The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
Use SSO Template   If you select None, you must fill in the SSO Method Configuration area. Otherwise, the SSO Method Configuration area is not available; settings are configured with data supplied by the template you select.
Headers Header name-value pairs to send with the SSO method. Available when you select Advanced from the General Properties list.

Credentials Source settings for HTTP form-based SSO configuration

Setting Value Additional Information
Username Source Specifies the user name to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.username
Password Source Specifies the password to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.password

SSO configuration settings for HTTP form-based SSO configuration

Setting Value Additional Information
Destination (IP or Hostname) Defines the IP address or fully qualified domain name for the OWA server. Displays only when you select an SSO template for OWA.
Start URI Defines the start URI value. HTTP form-based authentication executes for SSO if the HTTP request URI matches the start URI value. Multiple start URI values in multiple lines can be entered for this attribute.

Supported session variable: start_uri

Pass Through If you select the Enable check box, cookies presented in the form propagate to the client browser. Defaults to cleared.  
Form Method Defines the SSO authentication method : GET or POST. Defaults to POST. If you specify GET, the SSO authentication method is an HTTP GET request.
Form Action Defines the form action URL used for HTTP authentication request for SSO. For example, /access/oblix/apps/webgate/bin/webgate.dll. If left blank, the original request URL is used for SSO authentication.

Supported session variable: form_action

Form Parameter For User Name Defines the parameter name of the logon user name. For example, the user ID is specified as the attribute value if the HTTP server expects the user name in the form of userid=.

Supported session variable: form_parameter

Form Parameter for Password Defines the name of the logon password. For example, Pass is specified as the attribute value if the HTTP server expects the password in the form of Pass.
Hidden Form Parameters/Values Defines the hidden form parameters required by the authentication server logon form at your location. Specify a parameter name, a space, and the parameter value, if any. Each parameter must start on a new line. This example includes parameters for platform and language.
                              
platform %{session.client.platform}
                              language American English
Note: When using a session variable as a value, precede it with a percent (%) sign and enclose it in curly braces ({}).
Successful Logon Detection Match Type Defines how Access Policy Manager® detects whether the user was successfully authenticated by the server. Defaults to None. You can select one option.
  • None No check is made for authentication success.
  • By Resulting Redirect URL Authentication success is checked for by examining the redirect URL from the HTTP response. Multiple values can be specified for this option.
  • By Presence Of Specific String in Cookie Authentication success is checked for by searching for the string in the response.

    Supported session variable: success_match_value

Successful Logon Detection Match Value Defines the value for the specific success detection type: the redirect URL or cookie name.

For By Resulting Redirect URL , you can specify multiple URLs and the system supports a single instance of the wildcard character (*) in a URL.

Creating an NTLMV1 SSO configuration

The NTLM authentication method employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to a server.
  1. On the Main tab, click Access > Single Sign-On > NTLMV1 .
    The NTLMV` screen opens.
  2. Click Create.
    The New SSO Configuration screen opens.
  3. In the Name field, type a name for the SSO configuration.
  4. From the Log Setting list, select one of the following options:
    • Select an existing APM log setting.
    • Click Create to create a new log setting.
  5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.
  6. In the SSO Method Configuration area, specify the relevant settings.
  7. Click Finished.

NTLMV1 SSO configuration settings

These configuration settings are available when you configure an NTLMV1 SSO method.

General Properties settings for NTLMV1 SSO configuration

Setting Value Additional Information
General Properties Basic or Advanced. Defaults to Basic. Additional settings are available when you select Advanced.
Name Name of the SSO configuration. The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
Headers Header name-value pairs to send with the SSO method. Displayed when you select Advanced from the General Properties list.

Credentials Source settings for NTLMV1 SSO configuration

Setting Value Additional Information
Username Source Specifies the user name to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.username
Password Source Specifies the password to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.password
Domain Source Specifies the domain to cache for single sign-on. Defaults to a session variable. Supported session variable: session.logon.last.domain

SSO configuration settings for NTLMV1 SSO configuration

Setting Value Additional Information
Username Conversion Check box is cleared by default. Select the check box to convert the PREWIN2k/UPN user name input format to the format you want to use for SSO. For example, convert domain\username or username@domain to username.
NTLM Domain Specifies the name of the domain where all users and groups are authenticated. Specifies a domain name.

Creating an NTLMV2 SSO configuration

With this method of authentication, NTLM employs a challenge-response mechanism for authentication, where the users can prove their identities without sending a password to a server. This version of NTLM has been updated from version 1.
  1. On the Main tab, click Access > Single Sign-On > NTLMV2 .
    The NTLMV2 screen opens.
  2. Click Create.
    The New SSO Configuration screen opens.
  3. In the Name field, type a name for the SSO configuration.
  4. From the Log Setting list, select one of the following options:
    • Select an existing APM log setting.
    • Click Create to create a new log setting.
  5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.
  6. In the SSO Method Configuration area, specify the relevant settings.
  7. Click Finished.

NTLMV2 SSO configuration settings

These configuration settings are available when you configure an NTLMV2 SSO method.

General Properties settings for NTLMV2 SSO configuration

Setting Value Additional Information
General Properties Basic or Advanced. Defaults to Basic. Additional settings are available when you select Advanced.
Name Name of the SSO configuration. The name must begin with a letter, or underscore, and contain only letters, numbers, underscores, dashes, and periods. Avoid using global reserved words in the name, such as all, delete, disable, enable, help, list, none, show, or None.
Headers Header name-value pairs to send with the SSO method. Displayed when you select Advanced from the General Properties list.

Credentials Source settings for NTLMV2 SSO configuration

Setting Value Additional Information
Username Source Specifies the user name to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.username
Password Source Specifies the password to cache for single sign-on. Defaults to a session variable. Supported session variable: session.sso.token.last.password
Domain Source Specifies the domain to cache for single sign-on. Defaults to a session variable. Supported session variable: session.logon.last.domain

SSO configuration settings for NTLMV2 SSO configuration

Setting Value Additional Information
Username Conversion Check box is cleared by default. Select the check box to convert the PREWIN2k/UPN user name input format to the format you want to use for SSO. For example, convert domain\username or username@domain to username.
NTLM Domain Specifies the name of the domain where all users and groups are authenticated. Specifies a domain name.

About NTLMv2 SSO failure for an invalid HTTP 401 response

If an HTTP 401 response from a server includes more than one www-authenticate: NTLM header, NTLMv2 SSO fails. This is expected behavior. An HTTP 401 response should contain only one www-authenticate: NTLM header.

Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information