Forum Discussion
Kevin_Grumball_
Nimbostratus
NimbostratusExamining SAML claims for managing permissions
I'm designing a gateway for some legacy systems which cannot consume SAML. We have an STS which issues SAML tokens to end-user applications and these pass through the enterprise. It's a single STS, w...
Kevin_Grumball_Nimbostratus
NimbostratusYes, the SAML token is digitally signed by the STS, which is independent of the F5, or any external HTTPS. If we used ADFS internally for this (and we might) then it would have the same issues. The F5 gateway will have the public key of the STSs, so that it can validate the SAML tokens.
