Forum Discussion

sundogbrew's avatar
sundogbrew
Icon for Altocumulus rankAltocumulus
Jun 07, 2018

APM SAML help...

Let me start with I am new to both APM and SAML. I am running 12.1.2. I setup an access policy to allow or block access to a website using local users and it works fine, so I think I am good with t...
BIG-IP
BIG-IP Access Policy Manager (APM)
security
sundogbrew's avatar
sundogbrew
Icon for Altocumulus rankAltocumulus
Jun 12, 2018

Jens, Thanks for the response.

 

So I got to blablabla.mydomain.com which has the F5-As-SAML-SP set at it's Access policy. It is just a simple start->SAML Auth-> success or fail. It redirects me to our login page, I login successfully and get redirected back to my SP where I get connection reset error. It is an nonsecure error for the VIP for the SP f5sp.mydomain.com/saml/sp/profile/post/acs. It's like the SP passes the connection off fine and authentication is fine but on the return from the login page I get blown up by the F5sp vip.

 

Here is what I get in /var/log/apm

 

Jun 12 13:05:16 dc-lb1 notice tmm[28878]: 01490506:5: /Common/F5-As-SAML-SP:Common:6918d4fe: Received User-Agent header: Mozilla%2f5.0%20(Macintosh%3b%20Intel%20Mac%20OS%20X%2010_12_6)%20AppleWebKit%2f537.36%20(KHTML%2c%20like%20Gecko)%20Chrome%2f67.0.3396.62%20Safari%2f537.36.

 

Jun 12 13:05:16 dc-lb1 notice tmm[28878]: 01490500:5: /Common/F5-As-SAML-SP:Common:6918d4fe: New session from client IP 1.1.1.1 (ST=Pennsylvania/CC=US/C=NA) at VIP 2.2.2.2 Listener /Common/blablabla.com (Reputation=Unknown)

 

Jun 12 13:07:13 dc-lb1 notice tmm1[28878]: 01490502:5: /Common/F5-As-SAML-SP:Common:0d986505: Session deleted due to user inactivity.

 

Jun 12 13:07:14 dc-lb1 notice tmm[28878]: 01490502:5: /Common/F5-As-SAML-SP:Common:09f781f0: Session deleted due to user inactivity.

 

Does "(Reputation=Unknown)" matter? That's all I see in there that means anything.

 

Thank you Joe