For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Eric_Raff_11012's avatar
Eric_Raff_11012
Icon for Nimbostratus rankNimbostratus
Jul 22, 2014

APM as SAML SP and multiple host names

I have an existing LTM VIP that has multiple host names pointing to it. I would like to setup SAML authentication (as a service provider to an external IdP) on this VIP with an APM policy. I have tha...
BIG-IP Access Policy Manager (APM)
design
saml
security
sding_254965's avatar
sding_254965
Icon for Nimbostratus rankNimbostratus
Oct 25, 2017

R u doing one site for SAML SP auth, another site for local auth with built in logon page?

 

Or you have one site doing SAML SP first, and fall back to local auth?

 

  • Walter_Kacynski's avatar
    Walter_Kacynski
    Icon for Cirrostratus rankCirrostratus
    Oct 25, 2017

    It's 1 VIP and 1 Policy. I need to default to the logon page unless a special URL is invoked for SP Initiated or support IdP initiated.

     

  • sding_254965's avatar
    sding_254965
    Icon for Nimbostratus rankNimbostratus
    Oct 25, 2017

    Just have a macro, you can check the URL with general purpose empty, then construct your own branch, if expr { [mcget {session.server.network.name}] == "saml.foo.bar" }, then continue to a SAML Authentication. fallback, continue to an logon page, then local authentication.