F5 APM SAML SSO

Hi,

No, internal server (URL : ) is already configured with SAML auth with ADFS.

I now have to configure APM authentication (URL : https://myapp.comany.com, with ADFS auth too), then request a SAML token to ADFS for internal resource (URL : )

Hi Stanislas,

Did you manage to figure out if SSO SAML is working as expected?? (so APM is requesting SAML token an behave of an authenticated user for a SP)

Cheers,

Kees

Hi,

No, the customer changed the authentication method on the internal server from SAML to kerberos..

So Now users authenticate with SAML on APM and SSO is set to kerberos.

Hi,

That is unfortunate. My customer has a sharepoint site behind a APM with user/pw login on the APM where the sharepoint site does saml auth. When the access session time's out and a different user uses the browser (without closing it) they are authenticated in sharepoint as the previous user. (with the sharepoint auth cookie) (APM is not aware of the SAML auth to sharepoint)

Kees

Hi,

to remove previous session cookie, you can use this code (change the sharepoint cookie name):

when ACCESS_SESSION_STARTED {
    if { [HTTP::cookie exists sharepointcookie] } {
        ACCESS::session data set session.server.landinguri "/vdesk/cleanupCookie?url=[b64encode [ACCESS::session data get session.server.landinguri]]"
    }
}



when ACCESS_ACL_ALLOWED {
    switch -glob [string tolower [HTTP::path]] {
        "/vdesk/cleanupCookie" {
            ACCESS::respond 302 noserver Location [b64decode [URI::query [HTTP::uri] url]] "Set-Cookie" "sharepointcookie=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure"
        }
    }
}

Thanx,

But I have one other question about is, there are two or more authenticated websites behind the same access policy, how can I do the same trick for all of them?

Cheers,

Kees