For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ingebrigt_Maurs's avatar
Ingebrigt_Maurs
Icon for Nimbostratus rankNimbostratus
May 04, 2015

APM doesn't use RelayState value sent in Request

I have trouble making RelayState work. I use APM as an IDP-initiated SP. I send RelayState with the assertion. The spec for sending RelayState to APM as a SP is unclear/absent, so I send it in the sa...
BIG-IP Access Policy Manager (APM)
security
Ingebrigt_Maurs's avatar
Ingebrigt_Maurs
Icon for Nimbostratus rankNimbostratus
May 04, 2015

Also, if I set a default RealyState on the SP, this will break SP-initiated SSO.

I set default RelayState on the SP to 

https://myhost.no/default/path

As a client, I go to 

https://myhost.no/intended/path
.

As expected I get redirected to the IDP, authenticate, and then I am redirected back to the SP ACS with RelayState 

https://myhost.no/intended/path
. But unfortunately I am sent to 
https://myhost.no/default/path
. Correct behaviour would have been to be sent to my intended url 
https://myhost.no/intended/path
.

Michael_Koyfma1's avatar
Michael_Koyfma1
Icon for Cirrus rankCirrus
May 04, 2015
Ok, I am a little bit confused here, so need to clarify. Are you saying that APM is IDP and you are having issues with this config? If so, what is your SP? Is your goal to support both IDP and SP-initiated logons? The reason for my confusion is you continue to cite documentation about APM acting as SP and how it handles RelayState parameter - but to me, it sounds like you are using APM as an IDP - and that documentation portion does not apply then.