Forum Discussion
NimbostratusAzure SAML IdP
So we have an external IdP that is created using the federation information that we can download from our Azure account.
https://login.microsoftonline.com/{customer_id_string}/federationmetadata/2007-06/federationmetadata.xml
This is imported into the F5 configuration and we are able to use it successfully, my question revolved around they way the F5 support this federationmetadata.xml file we get from Azure. It contains 2 certificate and at different times each certificate can be valid but from the F5 side we can only every select the one.
Is there a way on the F5 side to select both certificate on the IdP so will will authenticate no matter which one Azure is configure to use?
Thanks
Chris
18 Replies
Chris_GuthrieSo I can post this link to the file but unsure if this is secure to do or if the federation info is public domain?
- Chris_Guthrie
So after we after hotfix we got from F5 the issue happened once and I switch to the other certificate, its not been an issue since but I don't no how often the certificate changes to be sure.
Sergi_Munyoz_24Hi Chris. I was thinking on idp not sp. I have experience with idp not sp, but usually read both types of metadata. So if I understand you are publishing sharepoint with F5 as SP against ADFS as IdP, is this correct ? Metadata is usually public as does not involve private keys, users or passwords, but you can mask your domain names as "yourcompany.com" f.ex. Also you can cut some parts of the certs on the file , but sure if they are from MS they are public
kunjanI think after the fix this cert changed should have automated. Next time if the issue happens you can try 'bigstart restart samlidpd'. If that fixes the issue, probably the issue persists. You also can check /var/log/saml_automation.log for any errors.
- Sergi_Munyoz_24
Hi Chris. I'm not able to test import of this on my F5, due to text format I suppose... Assuming SAML begins from: "IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" I can see 3 certificates, where 2 self-signed referring to CN=accounts.accesscontrol.windows.net are almost equal in parameters (with 2 weeeks of difference in issuing date, same key lenght,...) So I think is impossible to say which one is right unless you ask it to metadata issuer (Mr. MSft), or unless Idp Automation (no experience with this) chooses the right one for you
- Chris_Guthrie
Yeah I kind of agree with what your saying (it's between those 2 certs I've been switching) been trying to get that answer from MS still working that side. Thanks
- Sergi_Munyoz_24
No other way to solve it I think. Good luck with the question
- kunjan
Checking further shows MS also mention about this.
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-federation-metadata
A federation metadata document published by Azure AD can have multiple signing keys, such as when Azure AD is preparing to update the signing certificate. When a federation metadata document includes more than one certificate, a service that is validating the tokens should support all certificates in the document.
I don't think APM support this. May want to raise a support case.
