Forum Discussion

sachin_80710's avatar
sachin_80710
Icon for Nimbostratus rankNimbostratus
Jun 20, 2015

APM with NTLM SSO

Hi Team,

 

I have to deploy APM with NTLM SSO, anybody who have done this please share your input it's simple or very difficult. I have come across a link on devcentral https://devcentral.f5.com/articles/leveraging-big-ip-apm-for-seamless-client-ntlm-authentication. as per this link i need irule, but in f5 sso admin guide it is very simple configuration. The steps give in f5 sso admin guide is incomplete ? do i have to follow all the steps give in https://devcentral.f5.com/articles/leveraging-big-ip-apm-for-seamless-client-ntlm-authentication?

 

Thanks, Sachin

 

APM
deployment
security

8 Replies

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 21, 2015

    the first question with this is usually what do you want to exactly do? APM with NTLM SSO can mean two very different things, were one is easy and the other can require more config.

     

    please explain what you want more extensive then APM with NTLM SSO. where are your clients, where are your servers, what user experience do you expect?

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 24, 2015

    clear, so that is the "easy" variant of NTLM SSO. in principle you just have to add a SSO Credential Mapping VPE in your Policy (after your auth VPE) and add a NTLM SSO on your Access Profile (SSO / Auth Domains tab).

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jun 24, 2015

    NTLM SSO also require variable session.logon.last.domain is defined as NT domain name

     

    do a variable assign:

     

    session.logon.last.domain = expr {"DOMAIN"}

     

    • sachin_80710's avatar
      sachin_80710
      Icon for Nimbostratus rankNimbostratus
      Jun 30, 2015
      Hi Kunjan, yes, Im trying to do SSO over applications accessed over SSL VPN.
    • sachin_80710's avatar
      sachin_80710
      Icon for Nimbostratus rankNimbostratus
      Jun 30, 2015
      Hi Kunjan, yes, Im trying to do SSO over applications accessed over SSL VPN.
  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2015

    If so, have to create a VIP matching the webapp IP address as explained in the Solution article.

     

    Client <= via VPN tunnel => APM NA vs <--> layered VS <-> internal webapp server

     

    1) One http virtual for APM network access

     

    2) One or more http layered http virtuals corresponding to the internal webapp server that requires SSO support.