For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AJ_01_135899's avatar
AJ_01_135899
Icon for Cirrostratus rankCirrostratus
Mar 24, 2014

APM - Access Profile Automation

Here's the scenario:

 

  • Using APM as an IdP as part of a SP-initiated SAML SSO
  • Occasionally, in the lower environments the SP's Entity ID and Assertion Consumer Service URL (as configured in External SP Connector Settings) will change.

I'd like to implement a process where F5 administrators won't need to manually modify the Entity ID and Assertion Consumer Service URL every time these change. However, I'm not able to find any classes in iControl to modify APM Access Profiles. I'd be open to creative solutions on this, perhaps via iRules?

 

BIG-IP Access Policy Manager (APM)
deployment
devops
iControl
management
security

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Mar 25, 2014

    How about a REST iControl call?

    curl -k -u admin:admin -H "Content-Type: application/json" -X PUT -d '{"name":"testsp.domain.com","entityId":"https://testsp.domain.com","assertionConsumerUri":"https://testsp.domain.com/saml/sp/profile/post/acs"}' https://x.x.x.x/mgmt/tm/apm/sso/saml-sp-connector/testsp.domain.com

    where (in this example), "testsp.domain.com" is the name of the IdP's SP connector object. Depending on the SAML SP peer, you may also want to change singleLogoutResponseUri and singleLogoutUri. You can use the following to list the attributes of the SP connector:

    curl -k -u admin:admin -X GET https://x.x.x.x/mgmt/tm/apm/sso/saml-sp-connector/testsp.domain.com