Configuring nFactor authentication

The following diagram illustrates the high-level steps involved in nfactor configuration.

To understand the step-wise configurations for nFactor authentication, let us consider a 2-factor authentication deployment where the 1st factor is LDAP authentication and the 2nd factor is RADIUS authentication.

This sample deployment requires the user to login to both factors using a single login form. Therefore, we define a single login form that accepts two passwords. The first password is used for LDAP authentication and the other for RADIUS authentication.View XML file.

Here are the configurations that are performed.

1. Configure the load balancing virtual server for authentication

   add lb vserverlbvs55 HTTP 1.217.193.55 80 -AuthenticationHost auth56.aaatm.com -Authentication ON`

2. Configure the authentication virtual server.

   add authentication vserverauth56 SSL 1.217.193.56 443 -AuthenticationDomain aaatm.com

3. Configure the login schema for the login form and bind it to a login schema policy.

   add authentication loginSchemalogin1 -authenticationSchema login-2passwd.xml -userCredentialIndex 1 -passwordCredentialIndex 2

   add authentication loginSchemaPolicylogin1 -rule true -action login1

4. Configure a login schema for the pass-through and bind it to a policy label

   add authentication loginSchemalogin2 -authenticationSchema noschema

   add authentication policylabellabel1 -loginSchema login2

5. Configure the LDAP and RADIUS policies.

   add authentication ldapActionldapAct1 -serverIP 1.217.28.180 -ldapBase “dc=aaatm, dc=com” -ldapBindDn administrator@aaatm.com -ldapBindDnPassword 71ca2b11ad800ce2787fb7deb54842875b8f3c360d7d46e3d49ae65c41550519 -encrypted -encryptmethod ENCMTHD_3 -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN

   add authentication Policyldap -rule true -action ldapAct1

   add authentication radiusActionradius -serverIP 1.217.22.20 -radKey a740d6a0aeb3288fa0a6fbe932d329acddd8f448ecb4a3038daa87b36599fd16 -encrypted -encryptmethod ENCMTHD_3 -radNASip ENABLED -radNASid NS28.50 -radAttributeType 11 -ipAttributeType 8

   add authentication Policyradius -rule true -action radius

6. Bind the login schema policy to the authentication virtual server

   bind authentication vserverauth56 -policy login1 -priority 1 -gotoPriorityExpression END

7. Bind the LDAP policy (first factor) to the authentication virtual server.

   bind authentication vserverauth56 -policy ldap -priority 1 -nextFactor label1 -gotoPriorityExpression next

8. Bind the RADIUS policy (second factor) to the authentication policy label.

   bind authentication policylabellabel1 -policyName radius -priority 2 -gotoPriorityExpression end