Forum Discussion

PeteWhite's avatar
PeteWhite
Icon for Employee rankEmployee
Nov 09, 2020

An quick answer - find the session variable which contains the groups and add an Empty Box where the first branch uses mcget and expr

 

eg expr { [ mcget { session.saml.attr.groups } ] contains "Administrator" }

 

https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-visual-policy-editor-13-0-0/8.html

 

Start with this and move on from there

  • Oreoluwa's avatar
    Oreoluwa
    Icon for Altocumulus rankAltocumulus
    Nov 09, 2020

    Hi Pete, thanks for your reply. From the link you posted, i see that this expression was said to be useful in the variable assign block which is in the VPE of the access per request policy. Is it possible to use this same expression the per session policy for the advanced resource assign expression box? Secondly, while using this expression to specify groups, is there any where in the SP, IDP connector settings of the SAML that i have to specify this attirbute value in the expression you posted. I am asking because i have seen a box in the IDP connector settings named identity attribute location and i wouldnt know what is required in that box in the idp connector setting.

     

    • PeteWhite's avatar
      PeteWhite
      Icon for Employee rankEmployee
      Nov 09, 2020

      Yes, IIRC you can also use this in advanced resource assign - it is a general thing which is available in many of the VPE objects, both per-session and per-request.

      Not too sure what you mean about the IdP connector, I suspect that you are talking about using multiple IdPs. For instance, if you have a different landing URI, Host etc then you can send the request to a different IdP. What are you trying to do?

    • PeteWhite's avatar
      PeteWhite
      Icon for Employee rankEmployee
      Nov 09, 2020

      For more examples, take a look at this: https://devcentral.f5.com/s/articles/apm-variable-assign-examples-1107

    • Oreoluwa's avatar
      Oreoluwa
      Icon for Altocumulus rankAltocumulus
      Nov 09, 2020

      okay. This is what i am trying to do. I integrated my F5 APM with Azure using SAML for authentication and so as to setup SSO. SAML consists of IDP and SP. In my case, Azure is my IDP and F5 APM is my SP. Now you know when configuring the SAML on F5, you setup Local SP service and External IDP connector. Now the essence of my question is that, the SAML generates assertions from the IDP which contains session variables and attributes. Now i want the groupID attribute to be part of the assertion sent to F5 so that the VPE can process it and with my expression for specific azure GroupID, I can assign resources. Do you get this?

       

       

  • CA_Valli's avatar
    CA_Valli
    Icon for MVP rankMVP
    Jul 19, 2021

    Thanks for sharing! Solved me a similar issue. Upvoted.