AutoFill username for Office 365 Federation

Hi. I found that I had to add an additional iRule on the http_request to parse the referer to get the username and then append it to the URI if it contained a username parameter. Here is my final iRule

when HTTP_REQUEST {
     if { [HTTP::uri] starts_with "/saml/idp/profile/redirectorpost/sso" } {
          if { [HTTP::header exists "Referer"] } {
               set received_referer [HTTP::header "Referer"]
               log local0. $received_referer
               if { $received_referer contains "username="} {
                    log local0. "referer has username"
                    set username [URI::decode [URI::query $received_referer username]]
                    log local0. $username
                     HTTP::uri "/saml/idp/profile/redirectorpost/sso?username=[string map -nocase {"@" "%40"}$username]"
               }
               unset received_referer
           }
     }
}
when ACCESS_POLICY_AGENT_EVENT { 
if { [ACCESS::policy agent_id] eq "GetURIusername" } {
    set username [string map -nocase {"%40" "@"} [URI::query [ACCESS::session data get session.server.landinguri] username]]
    log local0. "NewUsername = $username"
    if  {$username != ""} {
         ACCESS::session data set session.custom.foundusername "1"  
         ACCESS::session data set session.custom.upn $username
         ACCESS::session data set session.logon.last.username $username
    }
}
}

We got this working in our environment.

The following iRule was used to capture the username from the incoming request from o365.

when ACCESS_POLICY_AGENT_EVENT { 
if { [ACCESS::policy agent_id] eq "GetURIusername" } {
    set username [string map -nocase {"%40" "@"} [URI::query [ACCESS::session data get session.server.landinguri] username]]
    log local0. "Username = $username"

    ACCESS::session data set session.custom.foundusername "1"   
    ACCESS::session data set session.custom.upn $username
    ACCESS::session data set session.logon.last.username [lindex [ split $username "@"] 0]

}

}

After that we have a branch rule that if session.custom.foundusername = 1 it goes to a logon page with a READ ONLY username field. If it's not set, you get a standard logon page.

If you don't have the username as read only it's not populated.

Note that in our iRule we removed the domain from the input as it caused issues.

HTH

Hello,

 

It's currently not possible to pass attributes in the authrequest.

 

As an alternative, you may configure SAML IDP initiated authentication. This way, the user complete the authentication process and is then redirected to the O365.