You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/f5-big-ip-forms-advanced.md
+51-52Lines changed: 51 additions & 52 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,80 +6,79 @@ ms.service: active-directory
6
6
ms.subservice: app-mgmt
7
7
ms.topic: how-to
8
8
ms.workload: identity
9
-
ms.date: 03/23/2023
9
+
ms.date: 03/24/2023
10
10
ms.author: gasinh
11
11
ms.collection: M365-identity-device-management
12
12
---
13
13
14
14
# Configure F5 BIG-IP Access Policy Manager for form-based SSO
15
15
16
-
In this article, you'll learn how to configure F5's BIG-IP Access Policy Manager (APM) and Azure Active Directory (Azure AD) for secure hybrid access to form-based applications.
16
+
Learn to configure F5 BIG-IP Access Policy Manager (APM) and Azure Active Directory (Azure AD) for secure hybrid access (SHA) to form-based applications. BIG-IP published services for Azure AD single sign-on (SSO) has benefits:
17
17
18
-
Enabling BIG-IP published services for Azure Active Directory (Azure AD) SSO provides many benefits, including:
18
+
* Improved Zero Trust governance through Azure AD preauthentication and Conditional Access
19
+
* See, [What is Conditional Access?](../conditional-access/overview.md)
20
+
* See, [Zero Trust security](../../security/fundamentals/zero-trust.md)
21
+
* Full SSO between Azure AD and BIG-IP published services
22
+
* Managed identities and access from one control plane
23
+
* See, the [Azure portal](https://azure.microsoft.com/features/azure-portal)
19
24
20
-
- Improved Zero Trust governance through Azure AD pre-authentication and [Conditional Access](../conditional-access/overview.md)
21
-
- Full single sign-on (SSO) between Azure AD and BIG-IP published services
22
-
- Identities and access are managed from a single control plane, the [Azure portal](https://azure.microsoft.com/features/azure-portal/)
25
+
Learn more:
23
26
24
-
To learn about all the benefits, see [Integrate F5 BIG-IP with Azure Active Directory](f5-aad-integration.md) and [What is application access and single sign-on with Azure AD?](../active-directory-appssoaccess-whatis.md).
27
+
*[Integrate F5 BIG-IP with Azure AD](./f5-aad-integration.md)
28
+
*[Enable SSO for an enterprise application](add-application-portal-setup-sso.md)
25
29
26
30
## Scenario description
27
31
28
-
For this scenario, we have an internal legacy application that's configured for basic form-based authentication (FBA).
32
+
For the scenario, there's an internal legacy application configured for form-based authentication (FBA). Ideally, Azure AD manages application access, because legacy lacks modern authentication protocols. Modernization takes time and effort, introducing the risk of downtime. Instead, deploy a BIG-IP between the public internet and the internal application. This configuraion gates inbound access to the application.
29
33
30
-
Ideally, application access should be managed directly by Azure AD but being legacy it lacks any form of modern authentication protocol. Modernization would take considerable effort and time, introducing inevitable costs and risk of potential downtime. Instead, a BIG-IP deployed between the public internet and the internal application will be used to gate inbound access to the application.
34
+
Wotj a BIG-IP in front of the application, you can overlay the service with Azure AD preauthentication and header-based SSO. The overlay improves application security posture.
31
35
32
-
Having a BIG-IP in front of the application enables us to overlay the service with Azure AD pre-authentication and header-based SSO, significantly improving the overall security posture of the application.
36
+
## Scenario architecture
33
37
38
+
The SHA solution has the following components:
34
39
35
-
## Scenario Architecture
40
+
***Application** - BIG-IP published service protected by SHA.
41
+
* The application validates user credentials against Active Directory
42
+
* Use any directory, including Active Directory Lightweight Directory Services, open source, and so on
43
+
***Azure AD** - Security Assertion Markup Language (SAML) identity provider (IdP) that verifies user credentials, Conditional Access, and SSO to the BIG-IP.
44
+
* With SSO, Azure AD provides attributes to the BIG-IP, including user identifiers
45
+
***BIG-IP** - reverse-proxy and SAML service provider (SP) to the application.
46
+
* BIG-IP delegating authentication to the SAML IdP then performs header-based SSO to the back-end application.
47
+
* SSO uses the cached user credentials against other forms-based authentication applications
36
48
37
-
The secure hybrid access solution for this scenario is made up of:
49
+
SHA supports SP- and IdP-initiated flows. The following diagram illustrates the SP-initiated flow.
38
50
39
-
**Application**: BIG-IP published service to be protected by and Azure AD SHA. This particular application validates user credentials against Active Directory, but it could be any directory, including Active Directory Lightweight Directory Services, open source, and so on.
51
+
40
52
41
-
**Azure AD**: Security Assertion Markup Language (SAML) Identity Provider (IdP) responsible for verification of user credentials, Conditional Access (CA), and SSO to the BIG-IP. Through SSO, Azure AD provides the BIG-IP with any required attributes including a user identifier.
42
-
43
-
**BIG-IP**: Reverse proxy and SAML service provider (SP) to the application, delegating authentication to the SAML IdP before performing header-based SSO to the backend application. The cached user credentials are then available for SSO against other forms-based authentication applications.
44
-
45
-
SHA for this scenario supports both SP and IdP initiated flows. The following image illustrates the SP initiated flow.
46
-
47
-
48
-
49
-
| Step | Description|
50
-
|-------: |:----------|
51
-
| 1 | User connects to application endpoint (BIG-IP).|
52
-
| 2 | BIG-IP APM access policy redirects user to Azure AD (SAML IdP).|
53
-
| 3 | Azure AD pre-authenticates user and applies any enforced CA policies.|
54
-
| 4 | User is redirected to BIG-IP (SAML SP) and SSO is performed using issued SAML token. |
55
-
| 5 | BIG-IP prompts the user for an application password and stores it in the cache. |
56
-
| 6 | BIG-IP sends a request to the application and receives a logon form.|
57
-
| 7 | The APM scripting auto responds, filling in the username and password before it submits the form.|
58
-
| 8 | The application payload is served by the web server and sent to the client. |
59
-
|||
53
+
1. User connects to application endpoint (BIG-IP).
54
+
2. BIG-IP APM access policy redirects user to Azure AD (SAML IdP).
55
+
3. Azure AD preauthenticates user and applies enforced Conditional Access policies.
56
+
4. User is redirected to BIG-IP (SAML SP) and SSO occurs using issued SAML token.
57
+
5. BIG-IP prompts the user for an application password and stores it in the cache.
58
+
6. BIG-IP sends a request to the application and receives a sign on form.
59
+
7. The APM scripting fills in the username and password, then submits the form.
60
+
8. The web server serves application payload and sends it to the client.
60
61
61
62
## Prerequisites
62
63
63
-
Prior BIG-IP experience is not necessary, but you'll need:
64
-
65
-
- An Azure AD free subscription or above
66
-
67
-
- An existing BIG-IP, or [deploy BIG-IP Virtual Edition (VE) in Azure](f5-bigip-deployment-guide.md).
0 commit comments