Forum Discussion
NimbostratusSAML Authentication
We've been using SAML authentication against our Azure hosted adfs/domain, this has worked fine but recently we been seeing issue where we get the following error.
SAML Agent: /Common/aprof_VERINTCONNECT_USERS_act_saml_auth_ag failed to process signed assertion, error: RSA decrypt
In the past we were able to workaround the problem by downloading a new version of the Federation xml and importing this to the F5 and binding that to the AAA SAML Server then things worked. But as of today this workaround has stopped and are unsure why.
F5 Version: BIG-IP 12.1.0 Build 1.22.1447 Engineering Hotfix HF1
Chris
2 Replies
Maybe this helps:
534555-1 : BIG-IP APM SAML and RSA v1.5 encryption key transport algorithm Component: Access Policy Manager
Symptoms: The BIG-IP APM SAML implementation by default does not support the deprecated RSA v1.5 key transport algorithm. F5 recommends against using this protocol, unless SAML interoperability is required for legacy 3rd party applications. Instead, RSA-OAEP should be used for key transport.
Symptoms differ based on BIG-IP APM usage: 1. When BIG-IP is used as SP, encrypted assertions with key transport algorithm 'RSA v1.5' will be rejected.
- When BIG-IP is used as IdP, encrypted assertions will always use RSA-OAEP as key transport algorithm.
Conditions: For BIG-IP as IdP: - External SP requires use of RSA 1.5 as key transport algorithm for encrypted assertion or encrypted elements within assertion.
For BIG-IP as SP: - External IdP generates assertion or encrypted elements within assertion using RSA 1.5 as key transport algorithm.
Impact: SAML interoperability will fail with peers attempting to use RSA v1.5 key transport algorithm.
Workaround: For BIG-IP used as SP - configure external IdP to use RSA-OAEP as encryption key transport algorithm.
There is no workaround for BIG-IP as IdP to generate encrypted assertion using RSA v1.5 as key transport algorithm.
Fix: Due to customer demand, starting with BIG-IP v12.1.0, the RSA v1.5 algorithm can be enabled on BIG-IP as IdP manually via console to TMSH, using this command:
modify apm sso saml key-transport-algorithm rsa-v1.5NOTE: Be sure to save the configuration after changes are made via TMSH.
Starting with BIG-IP v12.1.0, support for RSA v1.5 on BIG-IP as SP is enabled by default with no required configuration.
NabarunWe are using F5 system software are running on BIG-IP v12.1.2 , which is much more newer than the one you mentioned on this .
Still we are getting "SAML Agent: /Common/aprof_VERINTCONNECT_USERS_act_saml_auth_ag failed to process signed assertion, error: RSA decrypt"
Any other discripency ?
