Forum Discussion

Nicotrel's avatar
Nicotrel
Icon for Nimbostratus rankNimbostratus
Aug 30, 2018

APM - Okta Encrypted Assertion

Good day,

 

We have recently started to use APM as SP for some of our sites and Okta as idP. We followed this guide Okta Integration Guide for Web Access Management with F5 BIG-IP as a basis when doing the setups. We had them working as expected but now our Okta team has requested to enable encrypted assertion.

 

We have been unable to get it to work. WE have tired different self-signed certs and CA certs. Along with changing the different encryption options in Okta (Encryption Algorithm, Key Transport Algorithm). In the session log we see "SAML Agent: failed to process encrypted assertion, error: Cipher value from EncryptedKey element not found" regardless of what we try.

 

 

I have not found much details/info on enabling encrypted assertion so any guides, documents, or links would be appreciated. I have opened a support case to get assistance also.

 

Thank you

 

BIG-IP Access Policy Manager (APM)
security
  • Nicotrel's avatar
    Nicotrel
    Icon for Nimbostratus rankNimbostratus
    Sep 04, 2018

    From support case with F5: "BIG-IP as SP does not support RetrievalMethod for decrypting encrypted assertions from IdPs.

     

    We have the following Request for Feature Enhancement: ID 485387, "[RFE] BIG-IP does not support RetrievalMethod Element while processing encrypted assertion."

     

    Work around: To work around the problem, you can reconfigure the IdP to use embedded EncryptedKey instead of using RetrievalMethod."

     

    I am working with our team that works manages Okta to see if this change can be done.

     

    Jason

     

    • svs's avatar
      svs
      Icon for Cirrostratus rankCirrostratus
      Apr 02, 2020

      Hi,

       

      did you have any luck with changing the behavior of Okta? For 15.1.x it seems that the issue is still not resolved and while reconfiguring the Okta IdP there is only the Key Transport Algorithm, which doesn't change anything.

       

      The issue is tracked under ID 485387 (https://techdocs.f5.com/kb/en-us/products/big-ip_apm/releasenotes/product/relnote-apm-11-5-0.html#rn_ki_apm_1150), which is not listed in the Bug Tracker.

       

      From my understanding it seems to be not possible to encrypt the assertion between F5 BIG-IP and Okta. Or is my understanding wrong?

       

       

      Regards

      • Nicotrel's avatar
        Nicotrel
        Icon for Nimbostratus rankNimbostratus
        Apr 02, 2020

        After discussing with our security team, they agreed that we could go with non-encrypted for the assertion. We are only on 13.1 so we have not done anymore research testing with this.

         

        Jason