Forum Discussion

Johan_Lång's avatar
Johan_Lång
Icon for Cirrus rankCirrus
Jan 20, 2020

ADFS Proxy without password

Hello!   When a SP-initiated federation is initiated and the user gets to BIGIP APM you normally use a Logon page and send their credentails to ADFS with a "forms client initiated SSO".   Bu...
application delivery
BIG-IP
BIG-IP Access Policy Manager (APM)
  • Johan_Lång's avatar
    Johan_Lång
    Feb 05, 2020

    I figured it out. You need to configure a new claims provider (in this case BankID) and make it available to the RPs. Then you need to make BIGIP to choose wether to use the new CP or Active directory with an iRule.

Leonardo_Souza's avatar
Leonardo_Souza
Icon for Cirrocumulus rankCirrocumulus

Encrypt the SAML assertion (as it will be in the person browser), and pass the password as attributes in the SAML.

Extract the SAML attribute and add the value to the password variable in APM.

Johan_Lång's avatar
Johan_Lång
Icon for Cirrus rankCirrus
Jan 21, 2020

But there is no password to encrypt? The external idp only provices us with a "personal identity number" in the saml. Neither does these users has any account in our AD.