Is there a way in iRules to modify which IDP profile the APM selects?

Hi,

In the SAML SP/IdP Binding, you can check every session variable to choose IdP.

If you want to do the same as Office 365:

• create a logon page with email address form attribute.

• Create a variable assign with expression : session.logon.last.maildomain = if { [mcget {session.logon.last.email}] contains "@" } { set email [mcget {session.logon.last.email}]; return [string range $email [expr {[string first "@" $email] +1}] end ]; } else { return {[mcget {session.logon.last.email}] } }

   

• create a SAML Auth box

   

In the SAML Binding, choose the IdP based on the variable session.logon.last.maildomain