Forum Discussion

Chris_Guthrie's avatar
Chris_Guthrie
Icon for Nimbostratus rankNimbostratus
Mar 27, 2017

Azure SAML IdP

So we have an external IdP that is created using the federation information that we can download from our Azure account.

 

https://login.microsoftonline.com/{customer_id_string}/federationmetadata/2007-06/federationmetadata.xml

 

This is imported into the F5 configuration and we are able to use it successfully, my question revolved around they way the F5 support this federationmetadata.xml file we get from Azure. It contains 2 certificate and at different times each certificate can be valid but from the F5 side we can only every select the one.

 

Is there a way on the F5 side to select both certificate on the IdP so will will authenticate no matter which one Azure is configure to use?

 

Thanks

 

Chris

 

BIG-IP
BIG-IP Access Policy Manager (APM)
devops

18 Replies

Sort By
Show More
  • Chris_Guthrie's avatar
    Chris_Guthrie
    Icon for Nimbostratus rankNimbostratus
    Mar 27, 2017

    So I can post this link to the file but unsure if this is secure to do or if the federation info is public domain?

     

  • Chris_Guthrie's avatar
    Chris_Guthrie
    Icon for Nimbostratus rankNimbostratus
    Mar 27, 2017

    So after we after hotfix we got from F5 the issue happened once and I switch to the other certificate, its not been an issue since but I don't no how often the certificate changes to be sure.

     

  • Sergi_Munyoz_24's avatar
    Sergi_Munyoz_24
    Icon for Nimbostratus rankNimbostratus
    Mar 27, 2017

    Hi Chris. I was thinking on idp not sp. I have experience with idp not sp, but usually read both types of metadata. So if I understand you are publishing sharepoint with F5 as SP against ADFS as IdP, is this correct ? Metadata is usually public as does not involve private keys, users or passwords, but you can mask your domain names as "yourcompany.com" f.ex. Also you can cut some parts of the certs on the file , but sure if they are from MS they are public

     

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Mar 27, 2017

    I think after the fix this cert changed should have automated. Next time if the issue happens you can try 'bigstart restart samlidpd'. If that fixes the issue, probably the issue persists. You also can check /var/log/saml_automation.log for any errors.

     

  • Sergi_Munyoz_24's avatar
    Sergi_Munyoz_24
    Icon for Nimbostratus rankNimbostratus
    Mar 28, 2017

    Hi Chris. I'm not able to test import of this on my F5, due to text format I suppose... Assuming SAML begins from: "IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" I can see 3 certificates, where 2 self-signed referring to CN=accounts.accesscontrol.windows.net are almost equal in parameters (with 2 weeeks of difference in issuing date, same key lenght,...) So I think is impossible to say which one is right unless you ask it to metadata issuer (Mr. MSft), or unless Idp Automation (no experience with this) chooses the right one for you

     

    • Chris_Guthrie's avatar
      Chris_Guthrie
      Icon for Nimbostratus rankNimbostratus
      Mar 28, 2017

      Yeah I kind of agree with what your saying (it's between those 2 certs I've been switching) been trying to get that answer from MS still working that side. Thanks

       

    • kunjan's avatar
      kunjan
      Icon for Nimbostratus rankNimbostratus
      Mar 28, 2017

      Checking further shows MS also mention about this.

       

      https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-federation-metadata

       

      A federation metadata document published by Azure AD can have multiple signing keys, such as when Azure AD is preparing to update the signing certificate. When a federation metadata document includes more than one certificate, a service that is validating the tokens should support all certificates in the document.

       

      I don't think APM support this. May want to raise a support case.