Forum Discussion

Nifford's avatar
Nifford
Icon for Nimbostratus rankNimbostratus
Jan 26, 2016

F5 SAML IdP - SP Initiated SSO for Unauthorized User Behavior

We're using a Webtop to handle SP-Initiated and IdP-Initiated (Webtop Initiated) SAML SSO into multiple applications. Our access policy uses advanced resource assignment to assign specific SAML apps to specific users (AD Groups).

 

Unfortunately, if our users go to a SAML enabled website directly that they are unauthorized for, and performs an SP-Initiated login, the Access Policy allows them through, but doesn't assign them the SAML App, which results in a connection reset error after the access policy is completed.

 

Here is our Access Policy:

 

 

Is there a way to instead display an Unauthorized/Access Denied F5 page using the VPE? If so, how would I go about that since we are using advanced resource assignment?

 

BIG-IP Access Policy Manager (APM)
cloud
vpe
  • Daniel_W_'s avatar
    Daniel_W_
    Icon for Cirrus rankCirrus
    Jan 26, 2016
    I have the same issue and didn't find a solution until now. Hope that somebody can help us.
  • Walter_Kacynski's avatar
    Walter_Kacynski
    Icon for Cirrostratus rankCirrostratus
    Jan 26, 2016

    I asked this same question to support two weeks back and an RFE has been opened as ID515539

     

  • Michael_Ebbels's avatar
    Michael_Ebbels
    Icon for Nimbostratus rankNimbostratus
    May 13, 2016

    Hi Guys,

     

    Have a look at the variable session.server.landinguri in apm.

     

    When an SP initiated request occurs, it should be hitting

     

    Create a logic check in APM for the SP resource and gracefully deny the user and vice vera.

     

    Hope that helps

     

    Cheers Mike