Users_Group_May_2016_new_better2
- 1. F5 Users Group Presentation By: Jonathan Spigler, ClearShark
- 2. Just a little about me… • Plymouth State University BS Information Technology • Came from the Pentagon as contractor • F5 enthusiast obviously… • In my spare time – Golfer …. Well I try – Scuba – Brunch • Getting Married in September
- 3. Why I became interested in These two products… But Why?...
- 4. How my first F5 experience happened • Needed to solve an authentication problem – CAC/Smart Card authentication – Sign Sign On Experience (Credential Delegation) – Work with Active Directory – Secure UAG ?
- 5. Real quick what is UAG? • Provides remote access to corporate Apps via portal or direct to site • SSO capabilities between multiple Apps • Direct Access Server Capabilities • Very customizable as far as authentication and Authentication server options CAC/SmartCard authentication Check! But there was a problem with using JUST UAG to deliver This application…
- 6. Good but not good enough… Short comings with UAG native LB and HA • Not flexible in LB • Difficult to scale up and scale down UAG servers • No Geo Failover Capabilities! • Mission critical app needed local and geo fault tolerance UAG ARRAY
- 7. to the Rescue• Easily scale up, scale down UAG • Geo failover • Flexible LB methods • Enter data center down? Operations continue uninterrupted • BONUS! iRules! HTTP redirect UAG ARRAY UAG ARRAY LTM LTM GTM GTM Site A Site B
- 9. Situation and Current Solution • Provide authentication capabilities to external DoD customers • Currently being addressed with Active Directory Accounts Or • Application Specific Identity Database The problem with that… • Caused AD “Bloat” • Account Administration Nightmare • Each app had unique authentication methodology • Identity Data not authoritative in authentication and authorization process – Inaccuracies in Identity Data • Insecure! Concept of the New Solution! Complete And Authoritative Identity Database Sync Daily Cached Copy Claims Based Authentication Authentication ServiceIdentity Provider (IdP) LDAP Query
- 10. Identity Provider and Claims Flow Identity Provider -Four headed dragon… -Made up of four servers Windows WAP Windows ADFS Custom CAC authentication App Windows ADLDS -Each Server have to be accessible by Client over HTTPS. Else app will not work! -Claim in the form of SAML token 1 2 3 ADLDS 4 LDAP Query 5 6 7 8 9 12 10 11 Access! Web Application
- 11. Where does F5 fit in? With LTM WAP ADFS Custom CAC Application ADLDS LTM LTM LTM HTTPS HTTPS HTTPS HTTPS LDAP HTTPS HTTPS We need Geo failover… -Rapid removal and Adding of Server nodes. Good for troubleshooting and scale out -load balance, HA, fault tolerant -health checks specific to service -no single point of failure -FYI all using the same LTM! Though it looks like 3 different devices But …
- 12. With LTM and GTM WAP ADFS Custom CAC Application ADLDS LTM LTM LTM HTTPS HTTPS HTTPS LDAP HTTPS HTTPS WAP ADFS Custom CAC Application ADLDS LTM LTM LTM HTTPS HTTPS HTTPS LDAP HTTPS HTTPS GTM GTM Benefits of GTM -Protect from entire data center or Support infrastructure Failure -Fail clients to site B servers if Site A servers needs maintenance HA at both local and geo levels Site A Site B
- 13. Looking Back… How could we improve the previous solutions? APM
- 14. What is APM? What is it? • Big-IP Module • Centralized Access Control • Policy Driven Application access control • Visual Policy Editor (VPE) • Flexible authentication methods and AAA servers • Simplified User SSO user experience. • Big-IP APM can be a SAML IDP(s) and (s)SP! What Can this do? • Simplify Architecture • Simplify Management and Troubleshooting • Flexibility in authentication Work flows using Visual Policy Editor
- 16. Improve First Solution APM Remove UAG Replace with APM Policy Use LTM still for Load Balancing APM will do CAC authentication Certificate Checking Credential Delegation SSO What did this do for us? • Simplify the architecture • Save Operational cost and time • Better Meet SLAs • Better detail on end user context and device (remove obscurity) • Option to create more dynamic authentication flows to meet a broader audience If needed • Oh also… UAG is End of Life as of April 2015.
- 17. What about the Enterprise Authentication Solution? APM What can APM do for us In relation to claims flow? -APM became the SAML IDP! -Simplify Claims flow -Flexibility in authentication -Supported Platform as Apposed to a custom Developed app What can APM do for us Operationally? -Reduce complexity.. A lot -supported documented Platform -Reduce troubleshooting pains Session Management Logging and Alerts! Session ID for reference!
- 18. What about the Enterprise Authentication Solution? LTM GTM LTM LTM LTM GTM LTM LTM APM APM What can APM do For our infrastructure? -reduce the number Of servers to manage -reduce complexity for operations meet SLAs Less angry customers -better insight to client and Connecting device
- 19. VPE Example of IDP Policy
- 20. Some References • Microsofts Guide to Claims Based Authentication https://msdn.microsoft.com/en-us/library/ff423674.aspx • F5 APM https://f5.com/products/modules/access-policy- manager • F5 Smart Card KCD https://www.f5.com/pdf/deployment- guides/kerberos-constrained-delegation-dg.pdf • F5 SAML IDP https://support.f5.com/kb/en- us/products/big-ip_apm/manuals/product/apm-saml- config-guide-11-3-0/2.html
- 21. Thank You
- 22. Questions
- 23. Appendix
- 24. Real quick…What are Claims? • Assertion of one’s self or another subject in a form of a token • Decouple of authentication from App • Centralize authentication • Usually represented in the form of SAML tokens • Commonly used in Web Authentication situations • Secured by HTTPS • Single Sign on Name: Jonathan Charles Spigler Height: 6 ft Eye Color: Hazel Hair: None… Organization: ClearShark Position: Systems Engineer EmployeeID: 1234567890 Email: jonathan@clearshark.com Building: Building A Phone Number: 555-5555
Editor's Notes
- #2: remove demo