Forum Discussion

Amit_4247's avatar
Amit_4247
Icon for Nimbostratus rankNimbostratus
Sep 20, 2017

APM as passthrough for SAML

Hi Guys,

 

I am new to SAML, I have a setup which needs me to Create a Portal on APM with External SP as Portal Icon on Webtop, this External SP redirects users to Internal IDP which users authenticates & will be redirected to External SP. I am bit stuck on the redirection from SP to IDP, it breaks as the host & header changes thus IDP rejects it.

 

Flow should be as below, but breaks on point 4

 

  1. User Login to APM Portal (AD Auth)
  2. User gets External SP Link as Portal Access ICON
  3. User Clicks SP & SP Redirects to Internal IDP for SAML Authentication
  4. User Session redirects to IDP which is Form/NTLM Based Auth (as of now I am not going to do SSO for this part)
  5. When User gets IDP Login page, he enters credential & will be redirected to External SP
  6. External SP accepts the SAML assertion/token & allows user.

Any clues or similar simple setup examples

 

BIG-IP Access Policy Manager (APM)
security
  • KeesvandenBos's avatar
    KeesvandenBos
    Icon for MVP rankMVP
    Sep 20, 2017

    Hi,

     

    Is the user able to reach the internal IDP page directly (so without the redirect)?

     

    Cheers,

     

    Kees

     

  • Amit_4247's avatar
    Amit_4247
    Icon for Nimbostratus rankNimbostratus
    Sep 21, 2017

    No SP & IDP cannot see each other, SP is on Internet & IDP is on Internal network In debug i see IDP Sending a Reset for HTTPS Session when redirection occurs, (going to check with IDP guys of what they see on their end & reason for Reset) I am testing from external user who can access the APM Webtop with SP published on it. They cannot see IDP directly, all connections need to be proxies via APM which has access to both external & internal resources.