Updated Date: 08/25/2026
F5 Access iOS supports OIDC feature from v3.2.0 or later and BIG-IP versions 17.5.1.3 or later, 21.0.0 or later.
F5 Access for iOS supports OpenID Connect (OIDC) authentication using the mobile default browser using ASWebAuthenticationSession. Browser-based OIDC strengthens security by enabling password-less authentication and modern MFA capabilities using FIDO2 security keys.
Administrators configure the OIDC provider, client credentials, and OAuth scopes in the BIG-IP connectivity profile. These settings are pushed to the client, which initiates authentication in the default browser; users complete sign-in with the identity provider and return to establish the VPN connection.
The OIDC support provides consistent authentication experience by enabling two-factor verification and Single Sign-On across Browser and F5 Access. It provides:
- Ability to perform password-less authentication and MFA using FIDO2 keys (For example, YubiKey)
- Single Sign-On for F5 Access and other enterprise apps that share a common IDP.
Beginning BIG-IP version 16.0.0, connectivity profile has optional OAuth Settings using which administrators can specify the OIDC authorization server discovery endpoint, Client ID, Scopes, and the Complete Redirection URI.
For security reasons, when configuring for OAuth settings, ensure that the BIG-IP local traffic policy enforces HTTPS by redirecting HTTP requests to HTTPS for a virtual server on the BIG-IP system. Refer OIDC RFC for details on OAuth 2.0 Authorization Framework.
OIDC authentication in F5 Access requires BIG-IP versions 17.5.1.3 or later, 21.0.0 or later and you must ensure to:
- Enable PKCE.
- Enable Web Logon. You can do this in one of the following ways:
- Enable Web Logon when adding configuration in the F5 Access client
- Use MDM to push a configuration that enables Web Logon.
- Add the URI
f5-oauth://redirectin the redirect URIs configured on IDP.
F5 Access leverages OIDC native application flow with PKCE enabled for performing authentication.