For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sding's avatar
sding
Icon for Nimbostratus rankNimbostratus
Dec 01, 2016

Can and How F5 APM as SP map SAML multi-valued attribute to network resources like LDAP group resource assign?

We knew that with ldap, we can use the following feature to assign and aggregate different network resources to different LDAP groups. SOL16306: AD and LDAP Group Resource Assign feature https://sup...
application delivery
BIG-IP Access Policy Manager (APM)
iRules
Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Dec 01, 2016

You can configure the access policy however you like. Any contents of any session variable can result in the assignment of any resource(s) and/or any ACL(s) or execution of any logic you want.

 

APM as SP will transform a multi-valued attribute contained in a SAML assertion from an IdP to a single session variable with the attribute name, and delimited by a pipe "|" symbol. This multi-valued feature was introduced first in BIG-IP APM v12.0.

 

To see this, simply configure it and then use the session variable viewer in the GUI or sessiondump command in the CLI.