Forum Discussion

gerard_teixido_'s avatar
gerard_teixido_
Icon for Nimbostratus rankNimbostratus
Nov 27, 2013

SSO network access

Hello, I searched other topics but i didn't find any solution for my problem.

 

We have SSL VPN configured for our employees. We have a login and password with a TOTP (Time-based One-time Password Algorithm) security code configured to access inside. (Image 1)

 

 

One time you are logged, we have a menu with differents links to differents virtual servers (Sharepoint, VPN,...), with differents Access Profiles, depending of the grade and group of the employee, but that requieres loggin another time with the same credentials (but not with the TOTP code) in every single virtual server/link (that has their own Access Profiles as I said) (Image 2).

 

 

I think the best way to do that is making some type of iRule, store the credentials the first time (only user and password), auto logon and automaticaly making the access, but I'm not really sure. I don't know if there is any other way.

 

Any idea can be useful.

 

Thank you.

 

APM
application delivery
cloud
devops
iRules
security

2 Replies

Sort By
  • Thomas_Gobet's avatar
    Thomas_Gobet
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2013

    APM integrates SSO functionnality.

     

    You can create a SSO configuration into Access Policy (HTTP Basic, NTMLv1 or v2, Kerberos, Forms, SAML).

     

    This link could be helpful : APM_config_sso

     

    Just in case you want to use variables somewhere else :

     

    * username is stored into : session.logon.last.username

     

    * password : session.logon.last.password

     

  • Matt_Dierick's avatar
    Matt_Dierick
    Icon for Employee rankEmployee
    Nov 28, 2013

    Be careful, in this case, portal web resources are linked with a second and different Access Policy. So the browser will present his first APM cookie to the second Access Policy.

     

    The second access policy will not request any credential and will grant access the connection (not a new). I'm not sure if we support such a solution.

     

    The best solution should be to use only one VS for APM (your access policy) and use SSO in this Access Policy.

     

    Let us know if we wrong or if you want more information.

     

    Matt