Forum Discussion
NimbostratusAccess Policy branch rule for multiple SP on same virtual server?
Hi, I'm new to SAML in F5 Big-IP LTM and APM but I'm trying to accomplish something quite simple.
I want to have one and the same virtual server for all my SAML federations (easier to maintain). Right now I only have one idp for an external SP, but I'm trying to setup another.
How can I in the APM access policy redirect an incoming connection from a specific URI to a specific idP hosted on the F5?
Right now the access policy is quite simple:
Start > SAML Auth > Successfull (Allow) Fallback (Deny)
Should I use advanced resource assign based on landinguri? And how do I do that properly?
Regards
Robert
Stanislas_Piro2Cumulonimbus
Hi,
you must create an empty box with multiple branches... expression of SP sp1.company.com must be:
expr { [mcget {session.server.network.name}] == "sp1.company.com" }on each branch, add a SAML auth box with dedicated SAML SP profile.
Abdessamad1Cirrostratus
I guess your F5 setup is playing the role of an IdP, but you have multipe IdP objects and want to use them depending on the SP.
In this case I would use an iRule that looks at the Referer header and select the correct IdP with the "WEBSSO::select" command.