SAML SP ACS Post back resulting in a 404
Hello,
I have one application configured to use APM via SAML authentication, the SP & IdP are both running directly on our F5 - this setup is working for many applications only for this one i have problems with the SAML flow.
So only some web ressources from this app are protected, we used here an iRule in order to handle this, when i access one of the protected URIs i will be redirected to our IdP in order to get the authentication (KRB Ticket), this is still working i get a session for it (Allowed state) and see also the correct SP in the reference. But the bost pack from Idp to the SP to the ACS /saml/sp/profile/post/acs is resulting in a 404
Accessing protected web ressource
-> www.app1.com/protected
No session right now so i will be redirected to Idp
-> idp.com/saml/idp/profile/redirectorpost/sso (Post; State 302)
Redirect back to SP
-> www.app1.com/saml/sp/profile/post/acs (Post; State 404)
Anybody an idea how to solve this or where i can start with the error search?
Thanks,
Christoph
Finally solved this topic with the help from F5 Support - thank you so much.
The main issue is that not my whole web app is protected through APM as this would have serious performance impacts, therefore we have defined some protected sites. When hitting any of these URIs APM will be enabled, default is disabled.
And in that code we forgot to also have /saml URI enpoint marked as protected site as this is the SAML SP endpoint after IdP Session was created. Now we come up with that iRule, which is working great for our purpose
when HTTP_REQUEST { # Check the requested HTTP path switch -glob [string tolower [HTTP::path]] { "/saml/*" - "/en/confidential/*" - "/de/confidential/*" - "/confidential/*" { # Enable APM for these paths ACCESS::enable } default { # Disable APM for all other paths ACCESS::disable } } }