For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Stanislas_Piron's avatar
Stanislas_Piron
Icon for Nimbostratus rankNimbostratus
Mar 01, 2017

F5 APM SAML SSO

Hi,

 

I am deploying a POC with F5 APM as reverse proxy and I have to publish internal resources configure with SAML auth.

 

I did not find any configuration how to configure it.

 

when I try to configure SAML SSO (in SSO menu, not SAML one), it create local IdP.

 

I do not want to create a SAML IdP but to authenticate user against existing SAML IdP.

 

Is it supported or have I to request customer to change internal authentication method?

 

Regards,

 

Stanislas

 

BIG-IP Access Policy Manager (APM)
saml sso
security

7 Replies

    • KeesvandenBos's avatar
      KeesvandenBos
      Icon for MVP rankMVP
      Apr 16, 2017

      Thanx,

       

      But I have one other question about is, there are two or more authenticated websites behind the same access policy, how can I do the same trick for all of them?

       

      Cheers,

       

      Kees

       

    • Stanislas_Piro2's avatar
      Stanislas_Piro2
      Icon for Cumulonimbus rankCumulonimbus
      Apr 14, 2017

      Hi,

       

      to remove previous session cookie, you can use this code (change the sharepoint cookie name):

       

      when ACCESS_SESSION_STARTED {
    if { [HTTP::cookie exists sharepointcookie] } {
        ACCESS::session data set session.server.landinguri "/vdesk/cleanupCookie?url=[b64encode [ACCESS::session data get session.server.landinguri]]"
    }
}



when ACCESS_ACL_ALLOWED {
    switch -glob [string tolower [HTTP::path]] {
        "/vdesk/cleanupCookie" {
            ACCESS::respond 302 noserver Location [b64decode [URI::query [HTTP::uri] url]] "Set-Cookie" "sharepointcookie=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure"
        }
    }
}
    • KeesvandenBos's avatar
      KeesvandenBos
      Icon for MVP rankMVP
      Apr 14, 2017

      Hi,

       

      That is unfortunate. My customer has a sharepoint site behind a APM with user/pw login on the APM where the sharepoint site does saml auth. When the access session time's out and a different user uses the browser (without closing it) they are authenticated in sharepoint as the previous user. (with the sharepoint auth cookie) (APM is not aware of the SAML auth to sharepoint)

       

      Kees