Forum Discussion
NimbostratusAPM with SAML for some, AD for others
How do I use SAML for some users, but AD authentication for others.
I have a lab setup where I am using SAML to authenticate to a web page. My F5 SP provides a login page which asks for email address. My policy looks like this....
Under BIgIP as SP I have a binding that binds my IdP with %{session.logon.last.domain} and a domain name. This functions correctly.
I would like to use the domain part of the email address to determine if SAML is required or AD authentication is required but I can not figure out how to add an AD authenticated domain as a SAML binding. I have been told that maybe a 'empty box' agent could help but I have not been able to find an example of its use.
You could extract the domain from the email address and set it with a 'variable assign'. Use something like this:
session.logon.last.domain = expr { [lindex [split [mcget {session.logon.last.username}] "@"] 1] }Then you can create an 'Empty Action' to create a Domain Decision box, to do either SAML auth or AD auth. For an example see:
