Skip to content

Commit f261476

Browse files
v-edmckillopv-edmckillop
authored
Update f5-big-ip-forms-advanced.md
1 parent dc2ff3f commit f261476

File tree

1 file changed

+103
-95
lines changed

1 file changed

+103
-95
lines changed

‎articles/active-directory/manage-apps/f5-big-ip-forms-advanced.md

Lines changed: 103 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,8 @@ Configure the BIG-IP registration to fulfill SAML tokens that BIG-IP APM request
133133

134134
![Screenshot a Download option under SAML Signing Certificate.](./media/f5-big-ip-forms-advanced/saml-certificate.png)
135135

136-
> [!NOTE]
137-
> Azure AD SAML signing certificates have a lifespan of three years.
136+
> [!NOTE]
137+
> Azure AD SAML signing certificates have a lifespan of three years.
138138
139139
Learn more: [Tutorial: Manage certificates for federated single sign-on](tutorial-manage-certificates-for-federated-single-sign-on.md)
140140

@@ -155,157 +155,165 @@ Use the following instructions to configure BIG-IP.
155155

156156
SAML SP settings define the SAML SP properties that the APM will use for overlaying the legacy application with SAML pre-authentication. To configure them:
157157

158-
1. Select **Access** > **Federation** > **SAML Service Provider** > **Local SP Services**, and then select **Create**.
158+
1. Select **Access** > **Federation** > **SAML Service Provider**.
159+
2. Select **Local SP Services**.
160+
3. Select **Create**.
159161

160-
![Screenshot showing the F5 forms configuration.](./media/f5-big-ip-forms-advanced/f5-forms-configuration.png)
162+
![Screenshot of the Create option on the the SAML Service Provider tab.](./media/f5-big-ip-forms-advanced/f5-forms-configuration.png)
161163

162-
1. On the **Create New SAML SP Service** pane, provide a name and the same entity ID that you defined earlier in Azure AD.
164+
4. On the **Create New SAML SP Service** pane, for **Name** and **Entity ID**, enter the defined name and entity ID.
163165

164-
![Screenshot of the 'Create New SAML SP Service' pane, showing the name and entity ID of the new SAML service provider service.](./media/f5-big-ip-forms-advanced/saml-sp-service.png)
166+
![Screenshot of the Name and Entity ID fields under Create New SAML SP Service.](./media/f5-big-ip-forms-advanced/saml-sp-service.png)
165167

166-
The values in the **SP Name Settings** section are required only if the entity ID isn't an exact match of the hostname portion of the published URL or, equally, if the entity ID isn't in regular hostname-based URL format. Provide the external scheme and hostname of the application that's being published if the entity ID is *urn:myvacation:contosoonline*.
168+
> [!NOTE]
169+
> **SP Name Settings** values are required if the entity ID doesn't match the hostname portion of the published URL. Or, values are required if the entity ID isn't in regular hostname-based URL format.
167170
168-
### Configure an external IdP connector
171+
5. If the entity ID is `urn:myvacation:contosoonline`, enter the application external scheme and hostname.
169172

170-
A SAML IdP connector defines the settings that are required for the BIG-IP APM to trust Azure AD as its SAML IdP. These settings map the SAML service provider to a SAML IdP, which establishes the federation trust between the APM and Azure AD. To configure the connector:
173+
### Configure an external IdP connector
171174

172-
1. Select the new SAML service provider object, and then select **Bind/UnbBind IdP Connectors**.
175+
A SAML IdP connector defines settings for the BIG-IP APM to trust Azure AD as its SAML IdP. The settings connect the SAML service provider to a SAML IdP, which establishes the federation trust between the APM and Azure AD.
173176

174-
![Screenshot showing local service provider services and the 'Bind/Unbind IdP Connectors' button.](./media/f5-big-ip-forms-advanced/local-services.png)
177+
To configure the connector:
175178

176-
1. In the **Create New IdP Connector** dropdown list, select **From Metadata**.
179+
1. Select the new SAML service provider object.
180+
2. Select **Bind/UnbBind IdP Connectors**.
177181

178-
![Screenshot showing the 'From Metadata' option in the 'Create New IdP Connector' dropdown list.](./media/f5-big-ip-forms-advanced/from-metadata.png)
179-
180-
1. On the **Create New SAML IdP Connector** pane, browse for the Federation Metadata XML file that you downloaded earlier, and then provide an **Identity Provider Name** for the APM object that will represent the external SAML IdP (for example, *MyVacation\_AzureAD*).
182+
![Screenshot of the Bind Unbind IdP Connectors option on the SAML Service Provider tab.](./media/f5-big-ip-forms-advanced/local-services.png)
181183

182-
![Screenshot of the 'Create New SAML IdP Connector' pane for creating a new IdP SAML connector.](./media/f5-big-ip-forms-advanced/new-idp-saml-connector.png)
184+
3. In the **Create New IdP Connector** list, select **From Metadata**.
183185

184-
1. Select **Add New Row** to choose the new **SAML IdP Connector**, and then select **Update**.
186+
![Screenshot of the From Metadata option in the Create New IdP Connector dropdown list.](./media/f5-big-ip-forms-advanced/from-metadata.png)
185187

186-
![Screenshot showing how to add a new row.](./media/f5-big-ip-forms-advanced/add-new-row.png)
188+
4. On the **Create New SAML IdP Connector** pane, browse for the Federation Metadata XML file you downloaded.
189+
5. Enter an **Identity Provider Name** for the APM object that represents the external SAML IdP. For example, MyVacation\_AzureAD.
187190

188-
1. Select **OK** to save your settings.
191+
![Screenshot of Select File and Identity Provider name fields on Create New SAML IdP Connector.](./media/f5-big-ip-forms-advanced/new-idp-saml-connector.png)
189192

190-
![Screenshot of the 'Edit SAML IdPs that use this SP' pane.](./media/f5-big-ip-forms-advanced/edit-saml-idp-using-sp.png)
193+
6. Select **Add New Row**.
194+
7. Select the new **SAML IdP Connector**.
195+
8. Select **Update**.
196+
197+
![Screenshot of the Update option.](./media/f5-big-ip-forms-advanced/add-new-row.png)
191198

192-
### Configure Forms-based SSO
199+
9. Select **OK**.
193200

194-
In this section, you create an APM SSO object for performing FBA SSO to back-end applications.
201+
![Screenshot of the Edit SAML IdPs that use this SP dialog.](./media/f5-big-ip-forms-advanced/edit-saml-idp-using-sp.png)
195202

196-
You can perform FBA SSO in either client-initiated mode or by the BIG-IP itself. Both methods emulate a user logon by injecting credentials into the username and password tags before auto submitting the form. The flow is almost transparent, except that users have to provide their password once when they access an FBA application. The password is then cached for reuse across other FBA applications.
203+
### Configure forms-based SSO
197204

198-
This covers the APM approach, which manages SSO directly for the back-end application.
205+
Create an APM SSO object for FBA SSO to back-end applications.
199206

200-
Select **Access** > **Single Sign-on** > **Forms Based**, select **Create**, and then provide the following values:
207+
Perform FBA SSO in client-initiated mode or BIG-IP-initiated mode. Both methods emulate a user sign on by injecting credentials into the username and password tags. The form is then auto-submitted. Users provide password to access an FBA application. The password is cached and reused for other FBA applications.
201208

202-
|Property | Description |
203-
|:------|:---------|
204-
| Name | Use a descriptive name for the configuration, because an SSO APM object can be reused by other published applications. For example, use *Contoso\FBA\sso*.|
205-
| Use SSO Template | None |
206-
| Username Source | The preferred username source for pre-filling the password collection form. You can use any APM session variable, but the default *session.sso.token.last.username* tends to work best, because it contains the logged-in users' Azure AD UPN. |
207-
| Password Source | Keep the default *session.sso.token.last.password*, it's the APM variable that the BIG-IP will use to cache the password that's provided by users. |
208-
| | |
209+
1. Select **Access** > **Single Sign-on**.
210+
2. Select **Forms Based**.
211+
3. Select **Create**.
212+
4. For **Name**, enter a descriptive name. For example, Contoso\FBA\sso.
213+
5. For **Use SSO Template**, select **None**.
214+
6. For **Username Source**, enter the username source to pre-fill the password collection form. The default `session.sso.token.last.username` works well, because it has the signed-in user Azure AD UPN.
215+
7. For **Password Source**, keep the default `session.sso.token.last.password`, the APM variable BIG-IP uses to cache user passwords.
209216

210-
![Screenshot showing a new SSO configuration.](./media/f5-big-ip-forms-advanced/new-sso-configuration.png)
217+
![Screenshot of Name and Use SSO Template options under New SSO Configuration.](./media/f5-big-ip-forms-advanced/new-sso-configuration.png)
211218

212-
|Property | Description |
213-
|:------|:---------|
214-
| Start URI | The logon URI of your FBA application. The APM form-based authentication executes SSO when the request URI matches this URI value.|
215-
| Form Actions | Leave this value blank so that the original request URL is used for SSO. |
216-
| Form Parameter for Username | The element name of your logon form's username field. Use your browser's dev tools to determine this.|
217-
| Form Parameter for Password | The element name of your logon form's password field. Use your browser's dev tools to determine this.|
218-
| | |
219+
8. For **Start URI**, enter the FBA application logon URI. If the request URI matches this URI value, the APM form-based authentication executes SSO
220+
9. For **Form Action**, leave it blank. Then, the original request URL is used for SSO.
221+
10. For **Form Parameter for Username**, enter the logon form username field element. Use the browser dev tools to determine the element.
222+
11. For **Form Parameter for Password**, enter the logon form password field element. Use the browser dev tools to determine the element.
219223

220-
![Screenshot of the SSO Method Configuration pane.](./media/f5-big-ip-forms-advanced/sso-method-configuration.png)
224+
![Screenshot of Start URI, Form Parameter For User Name, and Form Parameter For Password fields.](./media/f5-big-ip-forms-advanced/sso-method-configuration.png)
221225

222-
![Screenshot of the Contoso 'My Vacation logon' webpage.](./media/f5-big-ip-forms-advanced/contoso-example.png)
226+
![Screenshot of the sign in page.](./media/f5-big-ip-forms-advanced/contoso-example.png)
223227

224-
For more information about configuring an APM for FBA SSO, go to the F5 [Single Sign-On Methods](https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration-14-1-0/single-sign-on-methods.html#GUID-F8588DF4-F395-4E44-881B-8D16EED91449) site.
228+
To learn more, go to techdocs.f5.com for [Manual Chapter: Single Sign-On Methods](https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration-14-1-0/single-sign-on-methods.html#GUID-F8588DF4-F395-4E44-881B-8D16EED91449)
225229

226230
### Configure an Access profile
227231

228-
An access profile binds many APM elements managing access to BIG-IP virtual servers, including access policies, SSO configuration, and UI settings.
229-
230-
1. Select **Access** > **Profiles / Policies** > **Access Profiles (Per-Session Policies)** > **Create**, and then provide the following values:
232+
An access profile binds APM elements that manage access to BIG-IP virtual servers, including access policies, SSO configuration, and UI settings.
231233

232-
| Property | Description |
233-
|:-----|:-------|
234-
| Name | For example, *MyVacation* |
235-
|Profile Type | All |
236-
| SSO Configuration | The FBA SSO configuration object you just created|
237-
|Accepted Language | Add at least one language|
238-
| | |
234+
1. Select **Access** > **Profiles / Policies**.
235+
2. Select **Access Profiles (Per-Session Policies)**.
236+
3. Select **Create**.
237+
4. Enter a **Name**.
238+
5. For **Profile Type**, select **All**.
239+
6. For **SSO Configuration**, select the FBA SSO configuration object you created.
240+
7. For **Accepted Language**, select at least one language.
239241

240-
![Screenshot showing how to create a new access profile.](./media/f5-big-ip-forms-advanced/create-new-access-profile.png)
242+
![Screenshot of options and selections on Access Profiles Per Session Policies, New Profile.](./media/f5-big-ip-forms-advanced/create-new-access-profile.png)
241243

242-
1. Modify the session policy to present a logon page with the username pre-filled. To launch the APM Visual Policy Editor, select the **Edit** link next to the per-session profile you just created.
244+
8. In the **Per-Session Policy** column, for the profile, select **Edit**.
245+
9. The APM Visual Policy Editor starts.
243246

244-
![Screenshot showing edit per-session policy](./media/f5-big-ip-forms-advanced/edit-per-session-policy.png)
247+
![Screenshot of the Edit option in the Per-Session Policy column.](./media/f5-big-ip-forms-advanced/edit-per-session-policy.png)
245248

246-
1. In the APM Visual Policy Editor, select the **+** sign next to the
247-
fallback.
249+
10. Under **fallback**, select the **+** sign.
248250

249-
![Screenshot of the APM Visual Policy Editor showing the plus sign (+) next to the fallback.](./media/f5-big-ip-forms-advanced/vpe-launched.png)
251+
![Screenshot of the APM Visual Policy Editor plus-sign option under fallback.](./media/f5-big-ip-forms-advanced/vpe-launched.png)
250252

251-
1. In the pop-up window, select **Authentication**, select **SAML Auth**, and then select **Add Item**.
253+
11. In the pop-up, select **Authentication**.
254+
12. Select **SAML Auth**.
255+
13. Select **Add Item**.
252256

253-
![Screenshot showing the 'SAML Auth' control selected and the 'Add Items' button.](./media/f5-big-ip-forms-advanced/saml-auth-add-item.png)
257+
![Screenshot of the SAML Auth option.](./media/f5-big-ip-forms-advanced/saml-auth-add-item.png)
254258

255-
1. On the **SAML authentication SP** configuration pane, change the name to **Azure AD Auth** and then, in the **AAA Server** dropdown list, enter the SAML service provider object that you created earlier.
259+
14. On **SAML authentication SP**, change the **Name** to **Azure AD Auth**
260+
15. In the **AAA Server** dropdown, enter the SAML service provider object you created.
256261

257262
![Screenshot showing the Azure AD Authentication server settings.](./media/f5-big-ip-forms-advanced/azure-ad-auth-server.png)
258263

259-
1. Select the **+** sign on the **Successful** branch.
260-
261-
1. In the pop-up window, select **Authentication**, select **Logon Page**, and then select **Add Item**.
262-
263-
![Screenshot shows logon page settings](./media/f5-big-ip-forms-advanced/logon-page.png)
264-
265-
1. In the **Read Only** column for the **username** field, in the dropdown list, select **Yes**.
266-
267-
![Screenshot showing the username 'Read Only' option changed to 'Yes'.](./media/f5-big-ip-forms-advanced/set-read-only-as-yes.png)
264+
16. On the **Successful** branch, select the **+** sign.
265+
17. In the pop-up, select **Authentication**.
266+
18. Select **Logon Page**
267+
19. Select **Add Item**.
268268

269-
1. Add an SSO Credential Mapping object by selecting the plus sign (**+**) for the logon page fallback.
269+
![Screenshot of the Logon Page option on the Logon tab.](./media/f5-big-ip-forms-advanced/logon-page.png)
270270

271-
1. In the pop-up window, select the **Assignment** tab, select **SSO Credential Mapping**, and then select **Add Item**.
271+
20. For **usesrname**, in the **Read Only** column, select **Yes**.
272272

273-
![Screenshot showing the 'SSO Credential Mapping' option and its description.](./media/f5-big-ip-forms-advanced/sso-credential-mapping.png)
273+
![Screenshot of the Yes option in the username row on the Properties tab.](./media/f5-big-ip-forms-advanced/set-read-only-as-yes.png)
274274

275-
1. On the **Variable Assign: SSO Credential Mapping** pane, keep the default settings, and then select **Save**.
275+
21. For the logon page fallback, select the **+** sign. This action adds an SSO credential mapping object.
276276

277-
![Screenshot showing the 'Save' button on the 'Variable Assign: SSO Credential Mapping' pane.](./media/f5-big-ip-forms-advanced/save-sso-credential-mapping.png)
277+
22. In the pop-up, select the **Assignment** tab.
278+
23. Select **SSO Credential Mapping**.
279+
24. Select **Add Item**.
278280

279-
1. Select the link in the upper **Deny** box to change the **Successful** branch to **Allow**, and then select **Save**.
281+
![Screenshot of the SSO Credential Mapping option on the Assignment tab.](./media/f5-big-ip-forms-advanced/sso-credential-mapping.png)
280282

281-
**(Optional) Configure attribute mappings**
283+
25. On **Variable Assign: SSO Credential Mapping**, keep the default settings.
284+
26. Select **Save**.
282285

283-
Although it's optional, adding a LogonID_Mapping configuration enables the BIG-IP active sessions list to display the UPN of the logged-in user instead of a session number. This information is useful when you're analyzing logs or troubleshooting.
286+
![Screenshot of the Save option on the Properties tab.](./media/f5-big-ip-forms-advanced/save-sso-credential-mapping.png)
284287

285-
1. Select the plus (**+**) symbol for the **SAML Auth Successful** branch.
288+
27. In the upper **Deny** box, select the link.
289+
28. The **Successful** branch changes to **Allow**
290+
29. Select **Save**.
286291

287-
1. In the pop-up dialog, select **Assignment** > **Variable Assign** > **Add Item**.
292+
#### (Optional) configure attribute mappings
288293

289-
![Screenshot showing the 'Variable Assign' option and its description.](./media/f5-big-ip-forms-advanced/variable-assign.png)
294+
You can add a LogonID_Mapping configuration. Then, the BIG-IP active sessions list has the signed-in user UPN, not a session number. Use this information for analyzing logs or troubleshooting.
290295

291-
1. On the **Properties** pane, enter a descriptive name (for example,
292-
*LogonID_Mapping*) and, under **Variable Assign**, select **Add new entry** > **change**.
296+
1. For the **SAML Auth Successful** branch, select the **+** sign.
297+
2. In the pop-up, select **Assignment**.
298+
3. Select **Variable Assign**.
299+
4. Select **Add Item**.
293300

294-
![Screenshot showing the 'Add new entry' field.](./media/f5-big-ip-forms-advanced/add-new-entry.png)
301+
![Screenshot of the Variable Assign option on the Assignment tab.](./media/f5-big-ip-forms-advanced/variable-assign.png)
295302

296-
1. Set both variables:
297-
298-
| Property | Description |
299-
|:-----|:-------|
300-
| Custom Variable | `session.logon.last.username` |
301-
| Session Variable | `session.saml.last.identity`|
302-
| | |
303+
1. On the **Properties** tab, enter a **Name**. For example, LogonID_Mapping.
304+
2. Under **Variable Assign**, select **Add new entry**
305+
3. Select **change**.
303306

304-
1. Select **Finished** > **Save**.
307+
![Screenshot of the Add new entry option and the change option.](./media/f5-big-ip-forms-advanced/add-new-entry.png)
305308

306-
1. Commit those settings by selecting **Apply Access Policy** and then close the Visual Policy Editor.
309+
4. For **Custom Variable**, use `session.logon.last.username`.
310+
5. For Session Variable, user `session.saml.last.identity`.
311+
6. Select **Finished**.
312+
7. Select **Save**.
313+
8. Select **Apply Access Policy**.
314+
9. Close the Visual Policy Editor.
307315

308-
![Screenshot showing the 'Apply Access Policy' pane.](./media/f5-big-ip-forms-advanced/apply-access-policy.png)
316+
![Screenshot of of the access policy on Apply Access Policy.](./media/f5-big-ip-forms-advanced/apply-access-policy.png)
309317

310318
### Configure a back-end pool
311319

0 commit comments

Comments
 (0)