SAML SLO request ignored on iRules

Hello,

Can you retry by adding the following line of codes on your irule :

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}

This peace of irule will allow you to manage with internal APM URIs.

Moreover, if you would be able to handle response coming from APM, you should change the HTTP_RESPONSE event by HTTP_RESPONSE_RELEASE.

Hello,

Can you retry by adding the following line of codes on your irule :

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}

This peace of irule will allow you to manage with internal APM URIs.

Moreover, if you would be able to handle response coming from APM, you should change the HTTP_RESPONSE event by HTTP_RESPONSE_RELEASE.

You can define a layered VS that apply your irule :

1. Change the IP address of your current VS (for example: 1.1.1.1) and remove your irule

2. Create a new VS (with published IP) and add your irule.

3. just add

   virtual /Common/Internal_VS

   to the end of the HTTP_REQUEST event of your irule (where Internal_VS is your VS with IP 1.1.1.1)

Thus, you will be able to manipulate REQUEST and RESPONSE (HTTP_RESPONSE) without any issues.

posting a complete solution

rule saml-inject rule

 irule to store the relay state at the logout (or predefined link)
 and inject the relay state to the reply

 this irule is to be applied to a front layer VS
 thus intercepting all HTTP events

when RULE_INIT {
 set static::virtual_SAML_server /Common/auth-test-vs
}

when HTTP_REQUEST {
  log local0. "[HTTP::host] [HTTP::method] [HTTP::uri]"

 set uri [HTTP::uri]
 set method [HTTP::method]

 if {$method equals "POST" and $uri equals "/saml/idp/profile/post/sls"} {
   
      if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] <= 1048576 } {
         set content_length [HTTP::header value Content-Length]
      } else {
           set content_length 1048576
      }
      if { $content_length > 0 } {
         HTTP::collect $content_length
         log local0. "request content collected: $content_length"
      } else {
         log local0. "cannot collect the content, length: $content_length"
      }
   }
   else {
     unset uri
     unset method
   }

  virtual $static::virtual_SAML_server
}


 at the SLO request, find the RelayState and store into the session
 triggered by HTTP::collect
when HTTP_REQUEST_DATA {
 
  if { [info exists "uri"] and [info exists "method"] } {
  if {$method equals "POST" and $uri equals "/saml/idp/profile/post/sls"} {
   set payload [HTTP::payload]
 
   set relaystate ""
    foreach x [split [ string tolower $payload] "&"] {
        if { $x starts_with "relaystate=" } {
            set relaystate [lindex [split $x "="] 1]
        }
    }
 
   log local0. "found relaystate: $relaystate"
   unset payload
   HTTP::release
   }
 }
}

when HTTP_RESPONSE {
 log local0. "response"
 if { [info exists "uri"] and [info exists "method"] } {
  if {$method equals "POST" and $uri equals "/saml/idp/profile/post/sls"} {
    if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] <= 1048576 } {
         set content_length [HTTP::header value Content-Length]
      } else {
           set content_length 1048576
      }
      if { $content_length > 0 } {
         HTTP::collect $content_length
         log local0. "response content collected: $content_length"
      } else {
         log local0. "cannot collect the content, length: $content_length"
      }
  }
 }
}


when HTTP_RESPONSE_DATA {
 log local0. "response data"
 if { [info exists "uri"] and [info exists "method"] } {
  if {$method equals "POST" and $uri equals "/saml/idp/profile/post/sls"} {
     set payload [HTTP::payload]
     set index [string first " 0 } {
     HTTP::payload replace $index 0 ""
     }
     unset payload
     unset index
     unset content_length
     unset relaystate
  }
 }

}

when HTTP_RESPONSE_RELEASE {
 log local0. "response release"
 HTTP::release
}