On the fisrt page (LoginPage.thtml) only prompt for "first" username and password. __ <% IF prompt.promptText == 'username' %> ... <% IF prompt.promptText == 'password' %> ... the second page will be displayed automatically (SecondaryLoginPage.thtml) <% IF prompt.promptText == 'Additional username' %> ... <% IF prompt.promptText == 'Additional password' %> ... ... View more

Hi, I don't think the XML import feature supports single policy deletion. Based on what you said, I would recommend taking a look at the NSM. This now supports the SA boxes and will be used for SSL Management going forward. I've started using our NSM to manage our SA's and have I'm saving a significant amount of time these days by being able to modify a single template and then push the changes down. -John ... View more

Thanks for the replies. We had to do a bit of custom work but I think we got it worked out. Olnly issue I think is if Juniper decides to change the way custom pages work or something it might break untill we can re-code. Anyway thanks for the help. ... View more

If you are looking to use a Captcha verification, you could try using a custom sign-in page. ... View more

I figured it out today, though I have to warn everyone that I ended up having to change some scripting on the YubiRADIUS server to get it working. It seems like the crux of the problem is that the YubiRADIUS server wants to behave as a proxy for AD/LDAP authentication, being the gateway to both factors of authentication. The SA wants those auth servers to be different and won't let you choose the RADIUS server for both factors of authentication. There doesn't appear to be any way to configure the Juniper SA box to send the username and password in the necessary format. However, the YubiRADIUS' ykval process calls a php script - /usr/share/yropval/ykropval-verify.php - that is expecting to see the AD password. When it doesn't, the process rejects the auth attempt and exits. Making the following changes to the php file solves this: Comment out the following lines from ykropval-verify.php: if (! $passwd) { // If password was not explicitly provided, we assume the password is anything // before the last 44 characters in $otp (legacy mode). if (strlen($otp) > 44) { $passwd = substr ($otp, 0, -44); $otp = strtolower(substr($otp, -44, 44)); } else { $passwd = null; $otp = strtolower($otp); } } if (! $passwd) { // As ldap_bind returns true for null password we are insuring that password should not be null $myLog->log(LOG_DEBUG, "NULL password is not allowed in two factor auth"); } Change the following line from: if ( !($otp && $user && $client && $password)){ to: if ( !($otp && $user && $client)){ Authentication succeeds after these changes. I'm verifying these changes with Yubico and will post their reply. ... View more