Cisco ASA Series Cli Configuration Manual page 1831

Chapter 1 Configuring Clientless SSL VPN
•
Configuring SSO with the HTTP Form Protocol
This section describes using the HTTP Form protocol for SSO. HTTP Form protocol is an approach to
SSO authentication that can also qualify as a AAA method. It provides a secure method for exchanging
authentication information between users of clientless SSL VPN and authenticating web servers. You
can use it in conjunction with other AAA servers such as RADIUS or LDAP servers. Prerequisites
To configure SSO with the HTTP protocol correctly, you must have a thorough working knowledge of
authentication and HTTP protocol exchanges.
Restrictions
As a common protocol, it is applicable only when the following conditions are met for the web server
application used for authentication:
•
Detailed Steps
The ASA again serves as a proxy for users of clientless SSL VPN to an authenticating web server but,
in this case, it uses HTTP Form protocol and the POST method for requests. You must configure the ASA
to send and receive form data.
Step 1
A user of clientless SSL VPN first enters a username and password to log into the clientless SSL VPN
server on the ASA.
Step 2
The clientless SSL VPN server acts as a proxy for the user and forwards the form data (username and
password) to an authenticating web server using a POST authentication request.
Step 3
If the authenticating web server approves the user data, it returns an authentication cookie to the
clientless SSL VPN server where it is stored on behalf of the user.
Step 4
The clientless SSL VPN server establishes a tunnel to the user.
Step 5
The user can now access other websites within the protected SSO environment without reentering a
username and password.
Subject Name format is uid=<user>
The authentication cookie must be set for successful request and not set for unauthorized logons. In
this case, ASA cannot distinguish successful from failed authentication.
Figure 1-4 illustrates the following SSO authentication steps:
Cisco ASA Series CLI Configuration Guide
Using Single Sign-on with Clientless SSL VPN
1-23