Product Documentation

Configuring nFactor Authentication

Aug 31, 2016

To understand the step-wise configurations for nFactor authentication, let us consider a 2-factor authentication deployment where the 1st factor is LDAP authentication and the 2nd factor is RADIUS authentication.

This sample deployment requires the user to login to both factors using a single login form. Therefore, we define a single login form that accepts two passwords. The first password is used for LDAP authentication and the other for RADIUS authentication. View XML file.

Here are the configurations that are performed.

  1. Configure the load balancing virtual server for authentication

    > add lb vserver lbvs55 HTTP 1.217.193.55 80 -AuthenticationHost auth56.aaatm.com -Authentication ON

  2. Configure the authentication virtual server.

    > add authentication vserver auth56 SSL 1.217.193.56 443 -AuthenticationDomain aaatm.com

  3. Configure the login schema for the login form and bind it to a login schema policy.

    > add authentication loginSchema login1 -authenticationSchema login-2passwd.xml -userCredentialIndex 1 -passwordCredentialIndex 2

    > add authentication loginSchemaPolicy login1 -rule true -action login1

  4. Configure a login schema for the pass-through and bind it to a policy label

    > add authentication loginSchema login2 -authenticationSchema noschema

    > add authentication policylabel label1 -loginSchema login2

  5. Configure the LDAP and RADIUS policies.

    > add authentication ldapAction ldapAct1 -serverIP 1.217.28.180 -ldapBase "dc=aaatm, dc=com" -ldapBindDn administrator@aaatm.com -ldapBindDnPassword 71ca2b11ad800ce2787fb7deb54842875b8f3c360d7d46e3d49ae65c41550519 -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN

    > add authentication Policy ldap -rule true -action ldapAct1

    > add authentication radiusAction radius -serverIP 1.217.22.20 -radKey a740d6a0aeb3288fa0a6fbe932d329acddd8f448ecb4a3038daa87b36599fd16 -encrypted -encryptmethod ENCMTHD_3 -radNASip ENABLED -radNASid NS28.50 -radAttributeType 11 -ipAttributeType 8

    > add authentication Policy radius -rule true -action radius

  6. Bind the login schema policy to the authentication virtual server

    > bind authentication vserver auth56 -policy login1 -priority 1 -gotoPriorityExpression END

  7. Bind the LDAP policy (first factor) to the authentication virtual server.

    > bind authentication vserver auth56 -policy ldap -priority 1 -nextFactor label1 -gotoPriorityExpression next

  8. Bind the RADIUS policy (second factor) to the authentication policy label.

    > bind authentication policylabel label1 -policyName radius -priority 2 -gotoPriorityExpression end