APM SP connections - Subject Types
Here is a general question on the functionality of the F5 APM module; we have been testing out SSO connections such as WebEx, ShareFile, (SP initiated). The original idea was to share or reuse the infrastructure, such as https://saml.domain.com to provide assertions with a public presence and a real certificate.
I’m quickly realizing that SPs need conflicting settings in regards to subject type. Is the only solution to create additional SP domains to handle the various types, along with additional certificates? I expect 3-4 would cover the majority of the SPs that require emailAddress versus Unspecified etc. Attributes seem to not be an issue as you can value many or any.
Or is there a way to value subject type based on the unique SP connectors? Thanks for the help.
If I understand you right, I think you might be under misconception about how SAML IDP configuration works on the BIG-IP. You can certainly have multiple IDP/SP bindings configured on the same virtual server. To fully visualize how it happens, I suggest you leverage this iApp to setup your initial federation with a couple of SaaS apps and take a look at the config it creates - should hopefully be self-explanatory after that. :) If not, fire away your questions here.
https://devcentral.f5.com/codeshare/saas-federation-iapp