For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Evan_Champion_1's avatar
Evan_Champion_1
Icon for Cirrus rankCirrus
Jan 04, 2016

Kerberos and APM-based SAML IdP

I am stuck getting transparent Kerberos authentication to work with my F5 APM-based SAML IdP. The user's first access to the IdP is successfully transparently authenticated. Following session expir...
BIG-IP Access Policy Manager (APM)
saml
security
Michael_Koyfman's avatar
Michael_Koyfman
Icon for Cirrocumulus rankCirrocumulus
Jan 04, 2016

Hi Evan,

 

I did investigate this a bit, and there does not appear to be a viable workaround, unfortunately, as you noted. Can I ask you to please open a support case with F5 and ask for it to be linked to that BZ as a request to fix it? Meanwhile, I am pursuing the urgency of this internally, and will post more details as we find out when exactly the issue will be addressed.

 

  • amolari's avatar
    amolari
    Icon for Cirrostratus rankCirrostratus
    Jan 04, 2016
    This BugID can be found only in RN of 11.5.3 and 12.0. Do you know what's about 11.6?
  • Evan_Champion_1's avatar
    Evan_Champion_1
    Icon for Cirrus rankCirrus
    Jan 04, 2016
    Thanks Michael -- yes, I will open a support case. This is a big problem for us not only for deployment of the planned SAML single sign-on service, but also for two other projects in-train using APM to provide Kerberos login to applications that don't support Kerberos. I would very much appreciate anything you can do internally to get the issue prioritised, while I try through the technical support team. I would be very happy to help test the fix.
  • Oz_201205's avatar
    Oz_201205
    Icon for Nimbostratus rankNimbostratus
    Mar 29, 2016
    @Evan & Mike; Google chrome for business does not seem to be having this issue and re-auth is transparent to the user. So this sounds to be only affecting IE... Have you experienced the same? what could be the reason for this disparity on end user's client? Also, i am wondering if the call to support resulted in an irule or an engineering HF and if it did address this issue or no? Thanks for sharing your feedback