Forum Discussion

Mike_Harpe_6170's avatar
Mike_Harpe_6170
Icon for Nimbostratus rankNimbostratus
Mar 25, 2015

SAML question

I am trying to get a SAML setup working and struggling.

 

Environment is LTM 11.5.1.HF7 on a 10200.

 

This is a 'BIG-IP as SP' setup. The iDp wants to receive the following URL from the BIG-IP in order to get started. If I paste this into a browser it works fine.

 

https://myaccess.dmdc.osd.mil/identitymanagement/authenticate.do?gotoUrl=https%3A%2F%2Fmyaccess.dmdc.osd.mil%2Fopensso%2Fidpssoinit%3FmetaAlias%3D%2Fauthorization%26spEntityID%3DHRC-WEB%26binding%3Durn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Abindings%3AHTTP-Artifact

 

If I use this as the Single Sign On Service Settings under Endpoint Settings it appears that the F5 is somehow trashing this by appending more parameters to it.

 

The end result is that my session does not initiate properly.

 

I am a total newbie to SAML. Any advice is appreciated.

 

BIG-IP Access Policy Manager (APM)
deployment
security

1 Reply

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Apr 05, 2015

    from that link it seems the IdP wants to do artifact binding, something BIG-IP as SP doesn't support in the 11.5.1. it is support from 11.6.0, but not for the initial contact I believe.

     

    you should check if your IdP can accept Post or Redirect as a way to start the process.