SAML Idp-Initiated Connections

The way that works the best for me is a Webtop..

Another tool I used when working out issues is SimpleSAMLPHP.. Real easy to stand up and test with F5.

Hi,

Actually, when you bind your external SP connector to your local IDP, this is not a SP initiated (not really). It depends how you configure your APM IDP policy. You can use an APM as IDP for SP initiated and IDP initiated. It depends the way your set your policy. If you use SAML resources assigned to your webtop, you can use APM as SP and IDP initiated. If you do not assign any SAML resource or webtop, you can not use IDP initiated.

I mean, if you reach SFDC in first (SP initiated), you will be redirected to the IDP for auth and redirected to SFDC when done. If you reach the IDP in first (IDP initiated), you will be prompted with your SAML resource (SFDC) on the webtop.

If the second vendor only supports IDP initiated, you need to use a SAML resource in order to push the SAML assertion at the first SP connection. SAML resource needs a webtop. I don't know if we can force APM to start a SAML resource after login so that user does not see the webtop.

May be a redirect on the policy ending.

Understanding the redirect ending-

http://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-config-11-4-0/apm_config_understanding.html

May be a redirect on the policy ending.

Understanding the redirect ending-

http://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-config-11-4-0/apm_config_understanding.html

Thanks Matt for testing. Tried an iRule that auto-launch the configured webtop saml resource. Seems to be working with a dummy SP.

when ACCESS_POLICY_COMPLETED {
 ACCESS::respond 302 Location "/saml/idp/res?id=/Common/my_saml_resource"
}

Good to know. I'm gonna test. I did test with the same URI but in the VPE ending. And actually I get a loop on APM /my.policy page.

The redirect ending deletes the cookies when redirected, even with 'Close session after redirect' option disabled. This creates the loop. Not sure if it's a bug or per design.

It works :-)

Thanks for the tip.

This iRule should work for both SP initiated and IdP initiated SAML IdP scenarios:

when ACCESS_POLICY_COMPLETED {
    if { [ACCESS::session data get session.server.landinguri] == "/saml/idp/profile/redirectorpost/sso" } { 
        log local0. "SP initiated SAML detected, not sending redirect"
    } else {
        ACCESS::respond 302 Location "/saml/idp/res?id=[ACCESS::session data get session.assigned.resources.saml]"
        log local0. "IDP initiated SAML detected, sending redirect"
    }
}

This iRule should work for both SP initiated and IdP initiated SAML IdP scenarios:

when ACCESS_POLICY_COMPLETED {
    if { [ACCESS::session data get session.server.landinguri] == "/saml/idp/profile/redirectorpost/sso" } { 
        log local0. "SP initiated SAML detected, not sending redirect"
    } else {
        ACCESS::respond 302 Location "/saml/idp/res?id=[ACCESS::session data get session.assigned.resources.saml]"
        log local0. "IDP initiated SAML detected, sending redirect"
    }
}