Contents
The F5 BIG-IP APM supports Duo two-factor authentication via OIDC, offering inline self-service enrollment and authentication with Duo Universal Prompt.
Overview
In this configuration, F5's BIG-IP APM acts as an Open ID Connect (OIDC) client and Duo acts as an identity provider for two-factor authentication, showing the interactive web-based Duo prompt. Unlike the Duo RADIUS configurations for F5 BIG-IP APM, there is no need to deploy any Duo software on your premises.
Use of Duo as an OIDC provider works with either F5 Modern or Standard customization. If your BIG-IP is at version 11 or 12 and you cannot update to a version that supports OIDC/OAuth, consider use of the Duo RADIUS with Auto Push configuration.
Prerequisites
Use of Duo as an OIDC/OAuth provider for BIG-IP APM requires the following:
- BIG-IP versions 13.1, 14.1x, 15.1x, 16.x, or later. Verify that your BIG-IP is running one of these versions before continuing.
- A primary authentication server configured for APM logins, typically an Active Directory domain controller or LDAP directory server.
- Direct outbound access from the BIG-IP to Duo's cloud service via HTTPS/443.
- DNS configured on the BIG-IP so it can perform lookups and resolve your Duo account's API hostname (i.e.
api-XXXXXXXX.duosecurity.com). - NTP configured on the BIG-IP with a reachable time server so that the device's time is correct.
First Steps
- Sign up for a Duo account.
- Log in to the Duo Admin Panel and navigate to Applications → Protect an Application.
-
Locate the entry for F5 BIG-IP APM Web in the applications list. Click Protect to the far-right to configure the application. and get your Client ID, Client secret, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications in Duo and additional application options.
Previously, the Client ID was called the "Integration key" and the Client secret was called the "Secret key".
Duo Universal Prompt
The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.
| Universal Prompt | Traditional Prompt |
 |
 |
We've already updated the Duo F5 BIG-IP APM Web application hosted in Duo's service to support the Universal Prompt, so there's no action required on your part to update the application itself. If you created your F5 BIG-IP APM Web application before March 2024, you can activate the Universal Prompt experience for users from the Duo Admin Panel. F5 BIG-IP APM Web applications created after March 2024 have the Universal Prompt activated by default.
If you created your F5 BIG-IP APM Web application before March 2024, it's a good idea to read the Universal Prompt Update Guide for more information, about the update process and the new login experience for users, before you activate the Universal Prompt for your application.
Activate Universal Prompt
Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications.
The "Universal Prompt" area of the application details page shows that this application is "Ready to activate", with these activation control options:
- Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
- Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.
The application's Universal Prompt status shows "Activation complete" here and on the Universal Prompt Update Progress report.
Should you ever want to roll back to the traditional prompt, you can return to this setting and change it back to Show traditional prompt. However, this will still deliver the Duo prompt via redirect, not in an iframe. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024.
Universal Update Progress
Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.
Configure your BIG-IP APM
Refer to the article APM Configuration to Support Duo MFA using iRule on F5 DevCentral and follow those step-by-step instructions for adding Duo authentication to your APM logins, using the F5 BIG-IP APM Web application you created earlier.
Test Your Setup
To test your setup, go to the URL you normally use to log in to your F5 BIG-IP APM in a browser window. After you complete primary authentication at the F5 BIG-IP, you'll be redirected to the Duo Prompt or Duo user enrollment. Completing Duo authentication returns you to the BIG-IP to complete your login.
*Universal Prompt experience shown.
The BIG-IP Edge Client also supports authentication with the Duo Prompt.
Troubleshooting
Need some help? Reach out to Duo Support for assistance with creating the F5 BIG-IP APM Web application in Duo, enrolling users in Duo, Duo policy questions, or Duo authentication approval issues. For assistance configuring or managing your BIG-IP device, including creating the iRule or updating the APM access policies, please contact F5 Support.