For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Vinne73_96575's avatar
Vinne73_96575
Icon for Nimbostratus rankNimbostratus
Nov 10, 2016

Hi Sam,

 

I've got the same problem. Client visit external SP, they do a POST to my F5, user is unauthenticated there, POST data = lost.

 

Did you get this decoding of POST data to work? Would you mind sharing this code? :)

 

Tx in advance Vincent

 

Sam_Hall's avatar
Sam_Hall
Icon for Nimbostratus rankNimbostratus
Nov 10, 2016

In the case where I couldn't determine what SP had generated the SamlRequest, I ended up forwarding the post data to a web service to tell me which IdPInitiated GET request I needed to generate. Using the HTTP Super Sideband library. I couldn't find a TCL way to crack open the SAMLRequest.

 

As a more generic solution to the lost POST data issue, I also toyed with recording the POST data from the payload and then later generating a form that auto-submits with some javascript. This worked but hurt my soul.