SAML SP ACS Post back resulting in a 404

Finally solved this topic with the help from F5 Support - thank you so much.

The main issue is that not my whole web app is protected through APM as this would have serious performance impacts, therefore we have defined some protected sites. When hitting any of these URIs APM will be enabled, default is disabled.

And in that code we forgot to also have /saml URI enpoint marked as protected site as this is the SAML SP endpoint after IdP Session was created. Now we come up with that iRule, which is working great for our purpose

when HTTP_REQUEST {
 
       # Check the requested HTTP path
       switch -glob [string tolower [HTTP::path]] {
              "/saml/*" -
              "/en/confidential/*" -
              "/de/confidential/*" -
              "/confidential/*" {
                     # Enable APM for these paths
                     ACCESS::enable
              }
              default {
                     # Disable APM for all other paths
                     ACCESS::disable
              }
       }
}