For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ingebrigt_Maurs's avatar
Ingebrigt_Maurs
Icon for Nimbostratus rankNimbostratus
May 04, 2015

APM doesn't use RelayState value sent in Request

I have trouble making RelayState work. I use APM as an IDP-initiated SP. I send RelayState with the assertion. The spec for sending RelayState to APM as a SP is unclear/absent, so I send it in the sa...
BIG-IP Access Policy Manager (APM)
security
Ingebrigt_Maurs's avatar
Ingebrigt_Maurs
Icon for Nimbostratus rankNimbostratus
May 04, 2015

Also, if I set a default RealyState on the SP, this will break SP-initiated SSO.

I set default RelayState on the SP to 

https://myhost.no/default/path

As a client, I go to 

https://myhost.no/intended/path
.

As expected I get redirected to the IDP, authenticate, and then I am redirected back to the SP ACS with RelayState 

https://myhost.no/intended/path
. But unfortunately I am sent to 
https://myhost.no/default/path
. Correct behaviour would have been to be sent to my intended url 
https://myhost.no/intended/path
.

  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    May 04, 2015
    Ok, I am a little bit confused here, so need to clarify. Are you saying that APM is IDP and you are having issues with this config? If so, what is your SP? Is your goal to support both IDP and SP-initiated logons? The reason for my confusion is you continue to cite documentation about APM acting as SP and how it handles RelayState parameter - but to me, it sounds like you are using APM as an IDP - and that documentation portion does not apply then.
  • Ingebrigt_Maurs's avatar
    Ingebrigt_Maurs
    Icon for Nimbostratus rankNimbostratus
    May 05, 2015
    I use APM as SP. My goal is to support both IDP and SP initiated logons. It is IDP initiated that is causing me trouble. BUT, SP initiated is also acting strange if I set a the 'RelayState' property of the SP configuration. If I as a client go to https://sp.no/intended/path I expected to end up there after SSO. But actually I end up at the URL specified by the RelayState property on the SP, if this is set. I'm unsure if this is a bug or a feature, but it certainly means I can't use the RelayState property. Because all clients using SP-initiated SSO will land on the URI specified in the RelayState property (and not on the landinguri they tried to reach).