Granular Access control policies

Question

We are trying to use the Big IP system as a SAML service provider and PingFederate as a SAML Identity Provider. &nbsp;Is it possible to create an access policy which allows/denies user to access a particular protected resource based on user atrributes or groups using F5 Big IP APM?

youssef1 · Answer

Hello,&nbsp;You don't have a specific documentation for your need. In fact you have to use a generic access policy for authentication and LDAP query in order to retrieve needed attribute.&nbsp;Then you can use an per-request-policy in order to restrict URL access by LDAP/AD GRP or other.&nbsp;I alread implement this need for an custoer and I use Datagroup in order to set right:grp_A       /uri1grp_B       /uri2grp_C       /uri3&nbsp;try to implent an per-request-policy... if you encouter a problem keep me in touch.&nbsp;regards

youssef1 · Answer

Hello,&nbsp;Yes of course, If you host your SP on F5 you can allows/denies user to access a particular SAML Attributes or LDAP attributes...&nbsp;You can also using per request policy allow user to access to a specific URI depending an LDAP/AD Attributes...&nbsp;give me exactly your need and I can help you to go ahead.&nbsp;regards

manoj_chavali · Answer

Hi,&nbsp;Thank you for the information. Could you please point me towards any document on how to implement the authorization based on the LDAP attributes?

youssef1 · Answer

Hi, &nbsp;First of would you check authorization&nbsp;on IDP or SP? The best practice is to check authorization&nbsp; on SP side, the IDP will return attribute to SP then SP will manage authorization.&nbsp;So you confirm that your SP is hosted on F5?&nbsp;regards

manoj_chavali · Answer

HiI don’t think you understood the question. I want to implement the attribute-based authorization on the SP side which is the F5 APM and not on the protected application. For example, if there are two resources abc.html and def.html, where abc.html can only be accessed by the directors and def.html can be accessed by developers. Can we implement this kind of access control using F5 Big-IP APM? If so, could you please point me towards the related document?Regards&nbsp;

Forum Discussion

Granular Access control policies

Recent Discussions

AS3 Limitations

Diameter iRules attachment?

Help needed with iRule (connection closed log )

Use of SSL Decryption.

VLAN Failsafe Functionality

Related Content

JWT authorization with NGINX Ingress Controller

Announcing F5 NGINX Ingress Controller v4.0.0

Why K8s Egress Traffic Policy Control is Critical to Security Architecture- Part 1

Why K8s Egress Traffic Policy Control is Critical to Security Architecture - Part 2

Overview of API Access Control and implementing API key access control with BIG-IP APM

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS