For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Doug_129661's avatar
Doug_129661
Icon for Nimbostratus rankNimbostratus
Sep 04, 2013

Manipulate SAML assertion data

I am new to F5 technology so I am not sure if this is areasonable question or not.   I wondered if it is possible to collect all the SAML data from the ID provider and then post that XML data to ...
application delivery
design
devops
iRules
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Feb 08, 2017

It's primarily because you're only sending the header if session.saml.last.sent is empty, and then immediately setting it to 1. Otherwise, ACCESS_ACL_ALLOWED does fire on every HTTP request.