Howto extract SAML NameID from AuthnRequest

Hi,

It is possible to extract the SAML authentication request passed in the GET query string. You need to inflate with an iRule LX. Like this :

https://devcentral.f5.com/s/feed/0D51T00007HPLCVSA5

# For a GET

set ilx_handle [ILX::init "Saml-plugin" "Saml-ext"]

# Try to base64 decode http query. Handle errors using catch.

#  Successful execution of b64decode by catch will return 0 and the output will be written to $SAMLdata

if {[catch {ILX::call $ilx_handle "inflate_b64" $requeteSAML} SAMLdata] == 0 and $SAMLdata ne ""}{

# base64 decoding succeeded

log local0. "SAML query string decoding succeeded : \[IP::client_addr\]: [IP::client_addr] \[SAMLdata\]: $SAMLdata"

} else {

# base64 decoding failed

log local0. "SAML query string decoding failed"

}

if {$SAMLdata ne ""}{

set SAML_Issuer_loc [string first "issuer" [string tolower $SAMLdata]]

set SAML_Issuer_start [expr {[string first ">" $SAMLdata $SAML_Issuer_loc] + 1}]

set SAML_Issuer_end [expr {[string first "<" $SAMLdata $SAML_Issuer_start] - 1}]

set SAML_Issuer [string range $SAMLdata $SAML_Issuer_start $SAML_Issuer_end]

log local0. "DEBUG SAML GET - issuer extracting : \[IP::client_addr\]: [IP::client_addr] \[HTTP::method\]: $methode \[PATH\]: $path \[SAML_Issuer\]: $SAML_Issuer"

}

For the authn request with a POST, you can do it like this : 

https://devcentral.f5.com/s/articles/apm-saml-idp-sp-issuer-extraction

Yves