For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kj07208_118528's avatar
kj07208_118528
Icon for Cirrus rankCirrus
Dec 02, 2013

SAML and signing the whole message

I'm trying to federate with a Saas, which we are using SAML 2.0. They require the SAML response message have a signature. Currently I think that F5 only signs the assertions. Is there a way for the whole message to be signed? I do have "Assertion sent to SP by this device -> Must by Signed" check off but the SP wants the whole message to have the whole message signed.

 

deployment
security

8 Replies

  • David_123856's avatar
    David_123856
    Icon for Nimbostratus rankNimbostratus
    Dec 05, 2013
    I have just discovered exactlly the same issue with one of our SaaS providers. Hoping someone has an answer
  • wonsoo_41223's avatar
    wonsoo_41223
    Historic F5 Account
    Dec 10, 2013

    The feature is added from v11.4.1, but the option is not integrated in GUI. It can be enabled with tmsh command.

     

    tmsh modify apm sso saml-sp-connector test-sp want_response_signed true

     

    tmsh save sys config

     

    • AlgebraicMirror's avatar
      AlgebraicMirror
      Icon for Altostratus rankAltostratus
      Jul 21, 2015
      Thank you! I just had this same problem, and this answered it. I guess it is still not surfaced in the GUI even in 11.5.3, but it is in TMSH.
  • kj07208_118528's avatar
    kj07208_118528
    Icon for Cirrus rankCirrus
    Jan 27, 2014

    Thanks it almost worked it also signed but Just one minor issue want_response_signed should be want-response-signed also if you use the tab key it will do autocomplete thanks again

     

  • Ronak_79648's avatar
    Ronak_79648
    Icon for Nimbostratus rankNimbostratus
    Apr 23, 2014

    Is there anyway to do same in 11.3.0 Build 3131.0 Hotfix HF6? Want to check before I ask for upgrade! thanks