Prepopulate APM Username From O365 Login

F5’s Access Policy Manager (APM) offers many compelling security and optimization features for Microsoft’s Active Directory Federation Services (ADFS) – more info in the APM/ADFS Deployment Guide.  Odds are if you’re deploying ADFS you’re also using or looking at Office 365.  Normally, when you login to O365 you will be redirect to a Home Realm Discovery page, login.microsoftonline.com.  This page does 2 things:

1. determines if you’re a federated users (i.e. you use another authentication source like F5, MS ADFS, Okta, …. <insert long list of IDMs on the market today>).
2. if you’re not a federated user, authenticate you against Azure AD.

So when you type in your email address Microsoft parses the domain name and automatically redirects you to your local APM/ADFS environment for authentication – pretty nice! However, when you land at the APM login page you notice the username field is empty and you have to enter your username or email address (depending on how APM is configured for authentication) again.

You can fix this by customizing the APM Visual Policy Editor to look for O365 to ADFS logins and prepopulate the username.

So what does the APM configuration look like?

Step 1: Create an object to detect O365 to ADFS Login 

1. Click the (+) button on the Start fallback branch
2. In the search box type empty and select the Empty resource then click “Add Item”
3.  Name the resource O365 Login
4. Click on the “Branch Rules” tab and click “Add Branch Rule”
5. Name the branch “Yes” and add the following expression via the advance tab
   • expr {[mcget {session.server.landinguri}] contains “username=”}
6. Click Save

 

 

Step 2: Extract the Username from the O365 Redirect Request

When the user enters their email address into the O365 login this data is included in the GET request back to the APM/ADFS environment.

To capture this data we’ll need to create perform the following steps:

1. Click the (+) button on the Yes branch off of O365 Login
2. In the search box type variable and select the Variable Assign resource then click “Add Item”
3. Name the resource “set username from O365” and add the following variables

session.logon.last.username = expr {[string range [mcget {session.server.landinguri}] [mcget {session.custom.pos_username}] [mcget {session.custom.pos_at_sign}]] }

session.custom.pos_at_sign = expr {[string first “%40” [mcget {session.server.landinguri}]] – 1}

session.custom.pos_username = expr {[string first “username=” [mcget {session.server.landinguri}]] + 9}

Click “Finished” and then click “Save”

Step 3: Customize the APM Logon Page

Now that we have the username we need to prepopulate it on the APM Logon page and set the form variable to read only.

1. Click the (+) button on the “set username from O365” fallback branch
2. Select “Logon Page’ then click “Add Item”
3. Name the resource “O365 Logon Page”
4. Change the “Read Only” setting for field 1 to “Yes”
5. Click  “Save”

The remainder of the VPE configurations are basic and are not covered in this article to keep it from being a novel.

That’s it!  Now you’re user’s only have to enter their information once which will definitely make them happier.