External authentication and role-based access control

Overview

F5 Insight now supports external authentication, enabling enterprise customers to integrate with their existing identity infrastructure for centralized user management and secure access control.

Previously, F5 Insight supported only a single local administrator account (username: admin, password: SSH-configured password). With this release, administrators can configure external authentication providers, allowing multiple users to log in using their corporate credentials with role-based access control.

What’s new

Feature Description
External Authentication Authenticate users via corporate LDAP or SAML identity providers
Supported LDAP Providers Open LDAP
Supported SAML Providers Ping, Okta
Role-Based Access Control (RBAC) Three predefined roles - Admin, Operator, Viewer - controlling access to features and API endpoints
Role Mapping Map external identity provider groups to F5 Insight roles

Authentication methods (existing)

F5 Insight supports two authentication methods:

Local authentication

Local authentication uses the built-in administrator account created during installation.

Attribute Details
Username admin
Password Configured during system setup (SSH password)
Access Level Full administrator access
Limitation Single user only; no role differentiation

External authentication (new)

External authentication allows users to log in using credentials managed by a corporate identity provider.

Provider Type Supported Providers Protocol Description
LDAP Open LDAP LDAP v3 Directory-based authentication using LDAP credentials
SAML Ping, Okta SAML 2.0 Single Sign-On (SSO) authentication via SAML identity providers

Note

Custom identity provider implementations outside of the supported LDAP (Open LDAP) and SAML (Ping, Okta) providers are not supported in this release.

Login flows

Login screen

After an external authentication provider is configured and activated, the F5 Insight login screen displays additional log-in options:

  • Local Login: Standard username and password fields for the built-in admin account.
  • External Login: One or more buttons labeled “Sign in with <Provider Name>” for each configured external provider.

The provider name displayed on the login screen corresponds to the name configured by the administrator during provider setup.

Local user login

  1. Navigate to the F5 Insight login page (https://<f5-insight-ip>).
  2. Enter the local username and password.
  3. Select Sign In.
  4. Upon successful authentication, you are redirected to the F5 Insight dashboard.

LDAP login

  1. Navigate to the F5 Insight login page.
  2. Select Sign in with <LDAP Provider Name> (for example, Log in with <LDAP Provider Name>).
  3. You are redirected to the LDAP credential screen.
  4. Enter your LDAP username and password.
  5. Upon successful authentication, you are redirected to the F5 Insight dashboard with permissions based on your assigned role.

SAML login

  1. Navigate to the F5 Insight login page.
  2. Select Sign in with <SAML Provider Name> (for example, “Log in with Okta” or “log in with Ping”).
  3. You are redirected to an intermediate authentication screen.
  4. On the intermediate screen, select the SAML log-in option again to proceed to the IdP authentication page.
  5. Enter the SAML credentials on the IdP authentication page.
  6. Upon successful authentication, you are redirected to the F5 Insight dashboard with permissions based on your assigned role.

Warning

Known Issue: In SAML login scenarios, selecting the external IdP log-in option redirects users to an intermediate screen. Users must select the SAML log-in option one more time to reach the IdP authentication page.

Note

By default, remote authentication uses an IP address for login page links and external auth endpoints. Use f5insight-set-fqdn to set a stable hostname instead. Using an FQDN is recommended for TLS certificate hostname validation, better user experience (friendly login URLs), and stable identity across IP changes. For more information, see Remote Authentication FQDN.

Session management

Behavior Details
Access Token Expiry Tokens expire after 5 minutes
Automatic Refresh Tokens are refreshed automatically in the background. No user action required
Session Timeout If token refresh fails, you are redirected to the login page
Logout Select the logout option to end your session

Note

Access tokens are stored in browser memory only and are never persisted to local storage, ensuring enhanced security.

Configuring identity providers (administrator only)

Important

You must be logged in as an Admin user to configure identity providers.

Configuring an LDAP provider

  1. Log in to F5 Insight as an administrator.
  2. Navigate to Settings ‣ User Administration ‣ SSO Identity Providers.
  3. Select LDAP.
  4. Fill in the required configuration fields:
Field Description Required
Provider Name Display name for the provider (appears on the login screen) Yes
Server URL LDAP server hostname or IP address with port (for example, ldap://ldap.example.com:389 or ldaps://ldap.example.com:636) Yes
Base DN Base Distinguished Name for user search queries Yes
Bind DN Distinguished Name used to authenticate with the LDAP server Yes
Bind Password Password for the Bind DN account Yes
LDAP Attributes Mapping of LDAP attributes to user properties (for example, mail, username, and so on) Yes
Userbase DN User search base DN Yes
User filters User lookup attribute key (for example, uid); do not use a full LDAP filter expression Yes
User object LDAP object class used for user entries Yes
  1. Select Create to save the configuration and Activate to enable the provider on the screen.

Note

Only one active LDAP and one active OKTA, PING are allowed.

Note

After activation, a “Log in with <Provider Name>” button appears on the login page immediately.

Note

For LDAP configuration, set User filters to uid in the example flow. Do not enter a full LDAP filter string such as (&(objectClass=inetOrgPerson)(uid={0})) in that field.

Note

The LDAP server must be reachable on a standard LDAP port: 389 for LDAP (or LDAP with StartTLS) and 636 for LDAPS. Make sure firewall and network policy rules allow traffic from F5 Insight to the selected port.

LDAP configuration notes and sample LDIF expectations

The following values represent the expected LDAP entry patterns used by OpenLDAP deployments similar to the sample data used for F5 Insight validation.

Expected user object classes and attributes

User entries are expected under a people container such as ou=People,dc=ldap,dc=example,dc=com with object classes:

  • person
  • organizationalPerson
  • inetOrgPerson

Common user attributes expected by provider mapping:

  • uid: login identifier (for example, adminuser)
  • mail: email address
  • cn: display name
  • givenName: first name
  • sn: last name
  • userPassword: LDAP bind password hash
Expected group object classes and attributes

Group entries are expected under a groups container such as ou=Groups,dc=ldap,dc=example,dc=com.

Dual-compatible group entries can include both:

  • groupOfUniqueNames with uniqueMember DN values
  • posixGroup with gidNumber and memberUid values

This supports both DN-based and POSIX username-based membership lookup.

Sample LDIF entry shapes
dn: uid=adminuser,ou=People,dc=ldap,dc=example,dc=com
 objectClass: person
 objectClass: organizationalPerson
 objectClass: inetOrgPerson
 uid: adminuser
 mail: adminuser@ldap.example.com
 cn: Addy Ministrator
 givenName: Addy
 sn: Ministrator
 userPassword: {SSHA}<hash>

dn: cn=admin,ou=Groups,dc=ldap,dc=example,dc=com
 objectClass: groupOfUniqueNames
 objectClass: posixGroup
 cn: admin
 gidNumber: 10002
 uniqueMember: uid=adminuser,ou=People,dc=ldap,dc=example,dc=com
 memberUid: adminuser
Associated OpenLDAP search commands

Use these commands to validate expected directory content and group mapping behavior.

# Base user lookup by uid
ldapsearch -x -H ldap://localhost \
 -b ou=People,dc=ldap,dc=example,dc=com \
 -D "cn=admin,dc=ldap,dc=example,dc=com" -w ldappass \
  "(uid=adminuser)" dn uid mail cn givenName sn

# Inspect one group and verify dual object classes and membership attributes
ldapsearch -x -H ldap://localhost \
 -b ou=Groups,dc=ldap,dc=example,dc=com \
 -D "cn=admin,dc=ldap,dc=example,dc=com" -w ldappass \
  "(cn=admin)" dn objectClass gidNumber uniqueMember memberUid

# POSIX-style group membership query
ldapsearch -x -H ldap://localhost \
 -b ou=Groups,dc=ldap,dc=example,dc=com \
 -D "cn=admin,dc=ldap,dc=example,dc=com" -w ldappass \
  "(memberUid=adminuser)" dn cn

# Dual-mode membership query (DN-based OR POSIX-style)
ldapsearch -x -H ldap://localhost \
 -b ou=Groups,dc=ldap,dc=example,dc=com \
 -D "cn=admin,dc=ldap,dc=example,dc=com" -w ldappass \
 "(|(uniqueMember=uid=adminuser,ou=People,dc=ldap,dc=example,dc=com)(memberUid=adminuser))" dn cn

Configuring a SAML provider

  1. Log in to F5 Insight as an administrator.
  2. Navigate to Settings ‣ User Administration ‣ SSO Identity Providers.
  3. Select SAML.
  4. Fill in the required configuration fields:
Field Description Required
Name Display name for the provider (appears on the login screen) Yes
Metadata XML / URL SAML metadata obtained from the IdP (Ping or Okta) Yes
Binding SAML binding type: POST or Redirect Yes
  1. Select Save to store the configuration.
  2. Select Create to enable the provider on the login screen.

Note

The administrator must first configure F5 Insight as a trusted Service Provider on the IdP (Ping or Okta), obtain the SAML metadata XML or URL, and then paste it into the F5 Insight configuration.

Part 2: Configure Okta

Initial F5 Insight for Okta

  1. Log in to F5 Insight as an administrator.
  2. Navigate to System Management -> User Administration -> SSO/Identity Providers.
  3. Select SAML from the available providers.
  4. Provide a name, metadata XML or metadata URL, and binding.

Note

We recommend to create the Okta application before starting this step. When initially creating the Okta SAML 2.0 application, the IAM administrator must supply placeholder values for Single Sign-On URL and Audience URI (SP Entity ID), for example https://<insight_fqdn_or_ip>. This allows working Metadata URL or XML values from the Okta app to be entered during F5 Insight provider setup.

Example App Values

Property Value
App Type SAML 2.0
App Name F5 Insight
Single sign-on URL https://<f5insight_fqdn_or_ip>
Audience URI (SP Entity ID) https://<f5insight_fqdn_or_ip>
Name Format EmailAddress
Application Username Email
  1. Save the provider.
  2. Select Edit for the new provider and expand the SAML Metadata section.
  3. Note the following values from F5 Insight:
    • SAML Metadata URL (Audience URI / SP Entity ID)
    • SAML ACS Intent API URL (Single sign-on URL)

Update the Okta application

  1. Log in to the Okta Admin Console and navigate to Applications.
  2. Select the previously created application.
  3. Configure SAML settings:
    • Single Sign-On URL: Paste the SAML ACS Intent API URL copied from F5 Insight.
    • Audience URI (SP Entity ID): Paste the SAML Metadata URL copied from F5 Insight.
  4. Go to Attribute Statements and add the required user attributes (set format to Basic).
Name Value
email user.email
lastname user.lastName
firstname user.firstName
username user.email
displayname user.displayName
  1. Add a Group Attribute Statement:
    • Name: groups
    • Name format: Unspecified
    • Filter: Select Matches regex and input .*
  2. Save the application.

Managing identity providers

Action Steps
View Providers Navigate to Settings > User Administration > SSO Identity Providers to view all configured providers
Activate Provider Select Activate on a configured provider to enable it on the login page
Deactivate Provider Select Deactivate to remove the provider from the login page without deleting the configuration
Edit Provider Select the provider and update the configuration fields, then select Save Changes
Delete Provider Select the provider and select Delete to remove the configuration
Test Provider Use the Validate option to test the provider configuration before activating

Note

Editing an LDAP provider: LDAP edit configuration requires a password to enable the test connection button.

Note

The Test Connection option is available for LDAP providers only. It validates the LDAP connection and retrieves the available LDAP groups.

API configuration

Identity providers can also be managed using the F5 Insight REST API.

Identity Provider Endpoints

Method Endpoint Description
GET /auth/identity-providers List all configured identity providers
POST /auth/identity-providers/ldap Create a new LDAP provider
POST /auth/identity-providers/saml Create a new SAML provider
GET /auth/identity-providers/{id} Get details of a specific provider
PUT /auth/identity-providers/ldap/{id} Update an LDAP provider
PUT /auth/identity-providers/saml/{id} Update a SAML provider
DELETE /auth/identity-providers/{id} Delete a provider
POST /auth/identity-providers/{id}/activate Activate a provider
POST /auth/identity-providers/{id}/deactivate Deactivate a provider
POST /auth/identity-providers/validate Test a provider configuration

Note

Refer to the F5 Insight API Documentation for detailed request/response schemas, payload examples, and authentication requirements.

Role-Based Access Control (RBAC)

F5 Insight enforces Role-Based Access Control (RBAC) to manage what each user can access and perform within the platform.

Predefined roles

Role Description Access Level
Admin Full system access including user management, device configuration, and all settings Full read/write access to all features and API endpoints
Operator Device configuration and troubleshooting Read/write access to devices, provisioning, telemetry, and system management. No access to User Administration
Viewer Read-only access for monitoring and observation View-only access to dashboards, devices, and configurations. Cannot add, edit, or delete resources

Role permissions matrix

Admin Role - Full Access

Operator Role - Operational Access

Viewer Role - Read-Only Access

Feature Area GET POST PUT/PATCH DELETE
Device Management Yes No No No
Telemetry Yes No No No
AI Integrations Yes No No No
Provisioning Yes No No No
System Management Yes No No No
License Management Yes No No No
User Management No No No No
Dashboards Yes Yes
Audit Console No No No No
Chat Management No No No No

Default role assignment

Scenario Assigned Role
Local admin user Always Admin
External user with a matching group attribute Role as per group-to-role mapping (Admin, Operator, or Viewer)
External user with no group attribute configured Defaults to Viewer

UI access by role

Feature / Section Admin Operator Viewer
Dashboards View - Yes View - Yes View - Yes
Devices - View Yes Yes Yes
Devices - Add/Edit/Delete Yes Add/Edit - Yes, Delete - No No
User Administration Yes No No
System Settings Yes Yes (limited) View-only / limited
AI Chat Yes Yes No / view-only if UI allows history
F5 Insight Upgrade Yes No No

Role mapping (administrator only)

Role mapping determines which F5 Insight role an external user receives upon login. Roles are assigned based on group attributes configured on the LDAP or SAML identity provider.

Navigate to Settings > User Administration > Role > Role Mapping

How role mapping works

  1. The administrator configures a group attribute on the LDAP or SAML server for each user or user group.
  2. When an external user logs in to F5 Insight, the system reads the group attribute from the authentication response.
  3. F5 Insight maps the attribute value to the corresponding role (Admin, Operator, or Viewer).
  4. The user is granted access based on the mapped role.
  5. If no matching group attribute is found, the user is assigned the Viewer role by default.

Configuring role mapping

  1. Log in to F5 Insight as an administrator.
  2. Navigate to Settings > User Administration > Role > Role Mapping.
  3. Select the configured identity provider (LDAP or SAML).
  4. Specify the group attribute name that the IdP uses to indicate the user’s role.
  5. Map the attribute values to F5 Insight roles:
IdP Group Attribute Value F5 Insight Role
(configured by admin, example, f5-admin) Admin
(configured by admin, example, f5-operator) Operator
(configured by admin, example, f5-viewer) Viewer
(no attribute or unmatched value) Viewer (default)
  1. Select Save.

Example - LDAP role mapping

LDAP User Group Attribute Value F5 Insight Role Access Level
john.smith f5-admin Admin Full access including User Administration
jane.doe f5-operator Operator Operational access, no User Administration
bob.wilson f5-viewer Viewer Read-only access
new.user (not configured) Viewer (default) Read-only access

Example - SAML role mapping (Okta / Ping)

SAML User Group Attribute in Assertion F5 Insight Role
admin@company.com admins Admin
operator@company.com operators Operator
user@company.com (no group attribute) Viewer (default)

Modifying or deleting role mappings

Action Steps Impact
Modify Mapping Navigate to Role Mapping, update the group attribute or role assignment, select Save. Changes take effect on the user’s next login
Delete Mapping Select the mapping, select Delete Mapping Users previously assigned via this mapping default to Viewer on their next login

Role mapping API endpoints

In this release, roles are read-only: GET /auth/roles and GET /auth/roles/{role_id}. No create role, update role, or edit permissions APIs.

Method Endpoint Description
GET /auth/roles List all available roles
POST /auth/roles Create a custom role (not available in this release)
GET /auth/roles/{role_id} Get role details and permissions
PUT /auth/roles/{role_id} Update a role
PUT /auth/roles/{role_id}/permissions Update role permissions

Checking your permissions

Any authenticated user can check their current permissions using the UI or API.

Viewing your permissions

Your assigned role and permissions are visible in the UI based on the features and actions available to you.

Use the following API endpoints to programmatically check your permissions:

Method Endpoint Description
GET /auth/me/permissions View your current role and permissions
POST /auth/permissions/check Check if you have permission for a specific action

Understanding access denied responses

HTTP Status Code Meaning Action
401 Unauthorized Your session has expired or your token is invalid Log in again
403 Forbidden You do not have permission to perform this action Contact your administrator to request the appropriate role