Forum Discussion

GNS_172075's avatar
GNS_172075
Icon for Nimbostratus rankNimbostratus
Mar 02, 2016

F5 APM || Multi domain support

Hi, I'm new to APM. We are doing a POC in our lab using F5 APM v11.6 to integrate with 2010 CAS for Outlook web app service.

 

Our AD infra have 3 domains in the same forest with bi-direction implicit trust.

 

Now the requirement is to get the user authentication by using his AD login id & pwd without using the domain name as the third option. Without selecting the domain name in the login page, we have to set the APM to query all the 3 domains and authenticate if the account is found in any one of the 3 domains.

 

pls let me know how this can be achieved? will querying all the 3 domains will be an ineffective way (will that coz delay in authentication), also would like to know if we have a better option to get this enabled.

 

Summary: Objective: user will key in only his domain id and pwd, without specifying the relevant domain name. APM should be able to identify the users domain (within the 3 domains available) and then authenticate to that domain using the key provided by the user in the login page.

 

Exmaple: "usera" - in "domain a" "userb" - in "domain b" "userc" - in "domain c"

 

domain a, b and c are in the same forest and have implicit trust.

 

users login in only with their username/pwd, so APM should find that "usera" is part of "domain a" and then authenticate him.

 

I hope the part 3 series of the below URL should have that info, but I'm no able to find that in my search. https://devcentral.f5.com/articles/apm-cookbook-multiple-domain-authentication-part-1

 

ad auth without domain name
APM
cross domain
security

2 Replies

Sort By
  • Josiah_39459's avatar
    Josiah_39459
    Historic F5 Account
    Mar 02, 2016

    If you have no logic to determine whether a given username is in domain a, b, or c, you have no choice but to query them all. Inefficient or not, it is your only option. You could store a username/domain database cache on the BIG-IP in the form of a datagroup and use an irule to lookup the correct domain, but you would be responsible for maintaining and keeping it current, and what happens if a given username is in multiple domains?

     

    Just have fallback a go to b, and fallback b go to c. Fallback of c (failed all three) is Deny. All the rest are Accept. Yes it will be slower for b and slowest for c, but it is your only option given your requirements above.