For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

THi_89722's avatar
THi_89722
Icon for Nimbostratus rankNimbostratus
Feb 24, 2015

Multi-valued SAML attributes not supported - any ideas/workarounds?

Currently APM does not support multi-valued SAML attributes (multiple same attribute instances within SAML assertion (Bug ID 400726, SOL 14570).   Consider authentication and access control based ...
BIG-IP Access Policy Manager (APM)
cloud
design
microsoft
security
r3ma_74410's avatar
r3ma_74410
Icon for Nimbostratus rankNimbostratus
Oct 16, 2015

The parser that creates SAML tokens for F5 IdP service doesn't allow you to put XML tag characters inside attributes. It rencodes them into their URL equivilents. So when I tried to replace the pipes with 'GROUP''GROUP' etc... it printed it into the SAML token like this:

<saml:attributevalue>'GROUP'<&bs;saml:attributevalue> etc...

So as you can se the parser for var stings into the token looks for XML junk. So you can't make your own tags.