F5 - Unable to Create Local Account with Remote Auth


When remote authentication is configured it is not possible (out of the box) to configure local user accounts. Other then the default admin and root accounts provided.

This is also stated within the TMOS Management Guide for BIG-IP Systems, which says: "Excluding the admin account, the entire set of standard user accounts that you create for BIG-IP system administrators must reside either locally on the BIG-IP system, or remotely on another type of authentication server."


In order to configure an additional local account when remote authentication is enabled a few extra commands are required. These are shown below,

First the account is configured within TMSH,

create auth user USERNAME role <admin/manager/operator/guest> shell <tmsh/none> partition-access all prompt-for-password

Next we configure the account to use local authentication.

run util bash
echo "USERNAME" >> /config/bigip/auth/localusers sed -ri 's/(localonlyusers LT_STRING_LIST.*)"/\1 \{USERNAME\}"/' /etc/confpp.dat

Tags: BIG-IP F5