Forum Discussion

sricharan61's avatar
sricharan61
Icon for Cirrus rankCirrus
Dec 03, 2019

how to use APM policy to grab user credentials from the http header and use them to login to external authentication database on behalf of the user

How to use APM policy to grab user credentials from the http header and use them to login to external authentication database on behalf of the user ? I am working on a requirement where a few application servers would be generating requests to the F5 protected APM web servers and would need F5 to look at the HTTP request headers and grab the authentication credentials from it and use them to login to azure AD on behalf of the application server. We are unable to use auth code or password grant type to have the app call redirect to azureAD login or simply present a F5 login page to input credentials because the app is not configured to input or respond with authentication credentials on any logon prompts. If an irule can be used to grab the user credentials, then we want the irule to be able to also trigger an APM policy that is configured to reach out to azure AD for login. The irule should present to the policy or policy should be able to grab the user creds extracted from the irule to go on and authenticate to azureAD on behalf of the requester as per its configuration

APM
application delivery
iRules

1 Reply

Sort By
  • Kin's avatar
    Kin
    Icon for Employee rankEmployee
    Dec 04, 2019

    Have you checked out apm clientless mode?

    https://support.f5.com/csp/article/K80934060#link_06_01

     

    and you can make use of the irule here

    https://clouddocs.f5.com/api/irules/ACCESS__user.html

    " set apm_username [ string tolower [HTTP::username] ]

    set apm_password [HTTP::password]"

     

    And finally configure AD servers on the APM and if necessary use sso.

    https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration-14-1-0/single-sign-on-methods.html