For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sding's avatar
sding
Icon for Nimbostratus rankNimbostratus
Dec 01, 2016

Can and How F5 APM as SP map SAML multi-valued attribute to network resources like LDAP group resource assign?

We knew that with ldap, we can use the following feature to assign and aggregate different network resources to different LDAP groups. SOL16306: AD and LDAP Group Resource Assign feature https://support.f5.com/kb/en-us/solutions/public/16000/300/sol16306.html

 

If F5 as SP, got a SAML from an external SAML IdP with the following memberof attribute CN=group1,OU=TestOU,DC=test,DC=test,DC=local CN=group2,OU=TestOU,DC=test,DC=test,DC=local CN=group3,OU=TestOU,DC=test,DC=test,DC=local

 

Can F5 map each value to APM resources and aggregate these resources for the session?

 

If yes, how does F5 do it?

 

application delivery
BIG-IP Access Policy Manager (APM)
iRules

1 Reply

  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Historic F5 Account
    Dec 01, 2016

    You can configure the access policy however you like. Any contents of any session variable can result in the assignment of any resource(s) and/or any ACL(s) or execution of any logic you want.

     

    APM as SP will transform a multi-valued attribute contained in a SAML assertion from an IdP to a single session variable with the attribute name, and delimited by a pipe "|" symbol. This multi-valued feature was introduced first in BIG-IP APM v12.0.

     

    To see this, simply configure it and then use the session variable viewer in the GUI or sessiondump command in the CLI.