You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* F5 BIG-IP Access Policy Manager™ (APM) add-on license on a BIG-IP F5 BIG-IP® Local Traffic Manager™ (LTM)
74
+
* 90-day BIG-IP full feature trial. See, [Free Trials](https://www.f5.com/trial/big-ip-trial.php)
75
+
* User identities synchronized from an on-premises directory to Azure AD
76
+
* See, [Azure AD Connect sync: Understand and customize synchronization](../hybrid/how-to-connect-sync-whatis.md)
77
+
* An SSL web certificate to publish services over HTTPS, or use default BIG-IP certs for testing
78
+
* See, [SSL profile](./f5-bigip-deployment-guide.md#ssl-profile)
79
+
* A header-based application or set up an IIS header app for testing
80
+
* See, [Set up an IIS header app](/previous-versions/iis/6.0-sdk/ms525396(v=vs.90))
74
81
75
-
* F5 BIG-IP Access Policy Manager™ (APM) add-on license on an existing BIG-IP F5 BIG-IP® Local Traffic Manager™ (LTM)
76
-
77
-
* 90-day BIG-IP full feature [trial license](https://www.f5.com/trial/big-ip-trial.php).
78
-
79
-
* User identities [synchronized](../hybrid/how-to-connect-sync-whatis.md) from an on-premises directory to Azure AD
80
-
81
-
* An account with Azure AD application admin [permissions](/azure/active-directory/users-groups-roles/directory-assign-admin-roles#application-administrator)
82
+
## BIG-IP configuration
82
83
83
-
* An [SSL Web certificate](./f5-bigip-deployment-guide.md#ssl-profile) for publishing services over HTTPS, or use default BIG-IP certs while testing
84
+
This tutorial uses Guided Configuration v16.1 with an Easy button template. With the Easy Button, admins no longer go back and forth to enable SHA services. The Guided Configuration wizard and Microsoft Graph handle deployment and policy management. The BIG-IP APM and Azure AD integration ensures applications support identity federation, SSO, and Conditional Access.
84
85
85
-
* An existing header-based application or [setup a simple IIS header app](/previous-versions/iis/6.0-sdk/ms525396(v=vs.90)) for testing
86
-
87
-
## BIG-IP configuration methods
88
-
89
-
There are many methods to configure BIG-IP for this scenario, including two template-based options and an advanced configuration. This tutorial covers the latest Guided Configuration 16.1 offering an Easy button template. With the Easy Button, admins no longer go back and forth between Azure AD and a BIG-IP to enable services for SHA. The deployment and policy management is handled directly between the APM’s Guided Configuration wizard and Microsoft Graph. This rich integration between BIG-IP APM and Azure AD ensures that applications can quickly, easily support identity federation, SSO, and Azure AD Conditional Access, reducing administrative overhead.
90
-
91
-
> [!NOTE]
92
-
> All example strings or values referenced throughout this guide should be replaced with those for your actual environment.
86
+
> [!NOTE]
87
+
> Replace example strings or values with those in your environment.
93
88
94
89
## Register Easy Button
95
90
96
-
Before a client or service can access Microsoft Graph, it must be trusted by the [Microsoft identity platform.](../develop/quickstart-register-app.md)
91
+
Before a client or service caaccesses Microsoft Graph, the Microsoft identity platform must trust it.
92
+
93
+
Learn more: [Quickstart: Register an application with the Microsoft identity platform](../develop/quickstart-register-app.md)
97
94
98
-
This first step creates a tenant app registration that will be used to authorize the **Easy Button** access to Graph. Through these permissions, the BIG-IP will be allowed to push the configurations required to establish a trust between a SAML SP instance for published application, and Azure AD as the SAML IdP.
95
+
Create a tenant app registration to authorize the Easy Button access to Graph. With these permissions, the BIG-IP pushes the configurations to establish a trust between a SAML SP instance for published application, and Azure AD as the SAML IdP.
99
96
100
-
1. Sign-in to the [Azure portal](https://portal.azure.com/) using an account with Application Administrative rights
101
-
2. From the left navigation pane, select the **Azure Active Directory** service
102
-
3. Under Manage, select **App registrations > New registration**
103
-
4. Enter a display name for your application. For example, *F5 BIG-IP Easy Button*
104
-
5. Specify who can use the application > **Accounts in this organizational directory only**
105
-
6. Select **Register** to complete the initial app registration
106
-
7. Navigate to **API permissions** and authorize the following Microsoft Graph **Application permissions**:
97
+
1. Sign-in to the [Azure portal](https://portal.azure.com/) with Application Administrative permissions.
98
+
2. In the left navigation, select **Azure Active Directory**.
99
+
3. Under **Manage**, select **App registrations > New registration**.
100
+
4. Enter an applciation **Name**.
101
+
5. Specify who uses the application.
102
+
6. Select **Accounts in this organizational directory only**.
103
+
7. Select **Register**.
104
+
8. Navigate to **API permissions**.
105
+
9. Authorize the following Microsoft Graph **Application permissions**:
107
106
108
107
* Application.Read.All
109
108
* Application.ReadWrite.All
@@ -116,32 +115,35 @@ This first step creates a tenant app registration that will be used to authorize
116
115
* Policy.ReadWrite.ConditionalAccess
117
116
* User.Read.All
118
117
119
-
8. Grant admin consent for your organization
120
-
9.In the **Certificates & Secrets** blade, generate a new **client secret** and note it down
121
-
10.From the **Overview** blade, note the **Client ID** and **Tenant ID**
118
+
8. Grant admin consent for your organization.
119
+
9.On **Certificates & Secrets**, generate a new **Client Secret**. Make a note of the Client Secret.
120
+
10.On **Overview**, note the Client ID and Tenant ID.
122
121
123
122
## Configure Easy Button
124
123
125
-
Initiate the APM's **Guided Configuration** to launch the **Easy Button** Template.
126
-
127
-
1. Navigate to **Access > Guided Configuration > Microsoft Integration** and select **Azure AD Application**.
124
+
1. Start the APM Guided Configuration.
125
+
2. Start the **Easy Button** template.
126
+
3. Navigate to **Access > Guided Configuration.
127
+
4. Select **Microsoft Integration**
128
+
5. Select **Azure AD Application**.
128
129
129
-
130
+
130
131
131
-
2. Review the list of configuration steps and select **Next**
132
+
6. Review the configuration steps.
133
+
7. Select **Next**.
132
134
133
-
135
+
134
136
135
-
3. Follow the sequence of steps required to publish your application.
137
+
8. Use the illustrated steps sequence to publish your application.
138
140
139
141
140
142
### Configuration Properties
141
143
142
-
The **Configuration Properties** tab creates a BIG-IP application config and SSO object. Consider the **Azure Service Account Details** section to represent the client you registered in your Azure AD tenant earlier, as an application. These settings allow a BIG-IP's OAuth client to individually register a SAML SP directly in your tenant, along with the SSO properties you would normally configure manually. Easy Button does this for every BIG-IP service being published and enabled for SHA.
144
+
Use the **Configuration Properties** tab to create a BIG-IP application config and SSO object. Azure Service Account Detailsrepresent the client you registered in the Azure AD tenant. Use the settings for BIG-IP OAuth client to register a SAML SP in your tenant, with SSO properties. Easy Button performs this action for BIG-IP services published and enabled for SHA.
143
145
144
-
Some of these are global settings so can be re-used for publishing more applications, further reducing deployment time and effort.
146
+
You can reuse settings to publish more applications.
145
147
146
148
1. Enter a unique **Configuration Name** so admins can easily distinguish between Easy Button configurations.
0 commit comments