Configuring nFactor authentication
The following diagram illustrates the high-level steps involved in nfactor configuration.
To understand the step-wise configurations for nFactor authentication, let us consider a 2-factor authentication deployment where the 1st factor is LDAP authentication and the 2nd factor is RADIUS authentication.
This sample deployment requires the user to login to both factors using a single login form. Therefore, we define a single login form that accepts two passwords. The first password is used for LDAP authentication and the other for RADIUS authentication.View XML file.
Here are the configurations that are performed.
Configure the load balancing virtual server for authentication
add lb vserverlbvs55 HTTP 1.217.193.55 80 -AuthenticationHost auth56.aaatm.com -Authentication ON`
Configure the authentication virtual server.
add authentication vserverauth56 SSL 1.217.193.56 443 -AuthenticationDomain aaatm.com
Configure the login schema for the login form and bind it to a login schema policy.
add authentication loginSchemalogin1 -authenticationSchema login-2passwd.xml -userCredentialIndex 1 -passwordCredentialIndex 2
add authentication loginSchemaPolicylogin1 -rule true -action login1
Configure a login schema for the pass-through and bind it to a policy label
add authentication loginSchemalogin2 -authenticationSchema noschema
add authentication policylabellabel1 -loginSchema login2
Configure the LDAP and RADIUS policies.
add authentication ldapActionldapAct1 -serverIP 1.217.28.180 -ldapBase “dc=aaatm, dc=com” -ldapBindDn administrator@aaatm.com -ldapBindDnPassword 71ca2b11ad800ce2787fb7deb54842875b8f3c360d7d46e3d49ae65c41550519 -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN
add authentication Policyldap -rule true -action ldapAct1
add authentication radiusActionradius -serverIP 1.217.22.20 -radKey a740d6a0aeb3288fa0a6fbe932d329acddd8f448ecb4a3038daa87b36599fd16 -encrypted -encryptmethod ENCMTHD_3 -radNASip ENABLED -radNASid NS28.50 -radAttributeType 11 -ipAttributeType 8
add authentication Policyradius -rule true -action radius
Bind the login schema policy to the authentication virtual server
bind authentication vserverauth56 -policy login1 -priority 1 -gotoPriorityExpression END
Bind the LDAP policy (first factor) to the authentication virtual server.
bind authentication vserverauth56 -policy ldap -priority 1 -nextFactor label1 -gotoPriorityExpression next
Bind the RADIUS policy (second factor) to the authentication policy label.
bind authentication policylabellabel1 -policyName radius -priority 2 -gotoPriorityExpression end