RSA SecurID® Access Integrations
Perform these steps to apply your RADIUS, SSO Agent, Relying Party or Authentication Agent configuration to F5 BIG-IP APM Step-up Authentication.
In this use-case F5 does the primary authentication, i.e. AD Password, then calls RSA SecurID access for additional authentication known as Step-Up authentication. The additional authentication can be done via SAML to cloud IdP (Relying Party) or via Radius.
Before you begin: Configure the integration type that your use case will employ. Refer to the Integration Configuration Summary section for more information.
Procedure
Note: It is assumed that there is an Access Profile (in this example it is named abtest-access-profile) and a Virtual Server (named as abtest_vs) already created and configured such that it can successfully perform AD authentication to grant access to a protected resource. The following steps gives instructions on how to modify the access profile to use RSA SecurID Access to grant access to the same protected resource. More detailed instructions on how to create and modify access policies and mapping access policies to virtual servers can be found in F5 BIG-IP APM's documentation. The Access Policy before modification is as shown below:
Create or modify an F5 Access Profile
1. Click Main > Access > Profiles / Policies > Access Profiles (Per Session Policies).
2. On the Access Profiles page, enter the name of the access profile to be modified in the search box and click Search.
3. Click on Edit... corresponding to the access profile to be modified.
4. On the Visual Policy Editor page, click on the + sign on the Successful transition of the AD Auth block.
5. On the pop-up window, click on Authentication tab and then click:
- RADIUS Auth radio button (for RADIUS with AM and RADIUS with CAS integration types)
- SAML radio button (for Relying Party and SSO Agent - SAML integration types)
6. Click Add Item.
7. On the next pop-up window, from the AAA Server drop-down list select:
- the RADIUS server configured in F5 (for RADIUS with CAS integration type).
- the the SAML SP Service configured in F5 (for Relying Party - SAML integration types).
12. Click Save.
13. Click Apply Access Policy and then click Close.
The fully configured access profile for each integration type will look as below:
- RADIUS with CAS
- Relying Party SAML
Create and link a F5 iRule
- Under Main > Local Traffic > iRules create or edit the required iRule
- Link Irule to Virtual Server
Return to Configuration Summary.
