Forum Discussion

EmBee_57573's avatar
EmBee_57573
Icon for Nimbostratus rankNimbostratus
Feb 26, 2014

SAML: APM as Service Provider (SP) role - is it possible to do SSO credential mapping to the backend server?

Hi I would like to setup the APM as Service Provider, having an external IdP. What I would like to do is pass the SAML token I receive, on to the backend server. The reason is that the SharePoint ser...
BIG-IP Access Policy Manager (APM)
deployment
design
microsoft
security
Pushpendu_Biswa's avatar
Pushpendu_Biswa
Icon for Nimbostratus rankNimbostratus

Hi,

 

But if I am able to send the password as an encoded SAML attribute in the assertion, cant that be extracted using iRule, decoded and insert as a session.logon.last.password and mapped as an SSO credentials mapping attribute?

 

Pushpendu_Biswa's avatar
Pushpendu_Biswa
Icon for Nimbostratus rankNimbostratus
Sep 14, 2017

The purpose is to use the F5 SP as the landing/gateway and use it as an auth broker as multiple backend applications with varying requirements - like OWA and custom IIS apps with NTLM. The F5 SP should be posting the creds to the backend app here with NTLM/forms auth. With the following iRule, I can get the user identity and any attribute in the SAML but not password. I wonder if F5 is stripping/blocking the key word "password" in the attribute or something is wrong with my b64decode.

Any help is highly appreciated.

====================================================================================

when ACCESS_ACL_ALLOWED {

        set username [ACCESS::session data get session.saml.last.identity]
        set password [b64decode [ACCESS::session data get session.saml.last.attr.name.password]] 
        log local0. "Username -$username, Password - $password"       
}
when ACCESS_SESSION_STARTED {
    if { [ info exists username ] } {
        ACCESS::session data set session.logon.last.username $username
    }
        if { [info exists password] } {
        ACCESS::session data set session.logon.last.password $password
    }
}