For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Doug_129661's avatar
Doug_129661
Icon for Nimbostratus rankNimbostratus
Sep 04, 2013

Manipulate SAML assertion data

I am new to F5 technology so I am not sure if this is areasonable question or not.   I wondered if it is possible to collect all the SAML data from the ID provider and then post that XML data to ...
application delivery
design
devops
iRules
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Sep 04, 2013

Here's an idea followed by some additional questions. On successful validation as the SP, the assertion content is actually stored in a session variable. I don't have it in front of me, but it's something like "session.saml.assertion". This is the decoded XML. So then there are a lot of options for what to do with that. And now the questions:

 

  1. Do you need to send this assertion data as an actual (encoded) assertion, or maybe something simpler like an HTTP header?

     

  2. If the former, do you need it in a POST request as the first request to the site and using a specific (potentially different) entityID/app URL?

     

  3. If yes to 2, do you need to validate the internal SP's response?