SAML SSO Without a Webtop

While there are a few ways to do this, is there a specific requirement to do IdP-initiated SAML? You could alternately do SP-initated, which would natively return you to the app without a APM webtop.

Are you going to be setting up an IDP just for a single cloud service? Reason I am asking is that it's pretty rare that customers setup a single cloud-based service in their environment - even if you start with one, there will always be more later one.. :)

Regarding bobscloud.company.com - your cloud-based service should be able to take care of it for you - so you will hit it, and it will automatically send you to your local IDP and after authenticating to APM, you will automatically receive a response/assertion sent back to the cloud service

I am new to SAML, so I do not really know what options are available.

I have deployed ADFS for Office365 behind the F5. So I am familiar with cloud service redirecting back to our IDP (not the F5 in the case of ADFS). And then being authenticated and shooting you back to the cloud service. I have not used the F5 for SAML before nor built an IDP initiated SAML Request.

I was asked if it was possible to do make an IDP initiated connection without a webtop.

It is definitely possible, but you'd need to use an iRule for that.

when ACCESS_POLICY_COMPLETED {

            log local0. "Policy Completed"
            switch -glob [ACCESS::session data get session.server.network.name] {
                            "bobscloud.company.comp"
                                            {
                                                                                                                           ACCESS::respond 302 Location "/saml/idp/res?id=/Common/bobscloud.com"
                                            }
                            }

}

The value you put in the ACCESS::respond should match the name of your SAML resource that is placed on the webtop - I named it bobscloud.com for you. Essentially, you're forcing a user to automatically hit the webtop-based IDP-initiated connection without seeing the webtop.

It is definitely possible, but you'd need to use an iRule for that.

when ACCESS_POLICY_COMPLETED {

            log local0. "Policy Completed"
            switch -glob [ACCESS::session data get session.server.network.name] {
                            "bobscloud.company.comp"
                                            {
                                                                                                                           ACCESS::respond 302 Location "/saml/idp/res?id=/Common/bobscloud.com"
                                            }
                            }

}

The value you put in the ACCESS::respond should match the name of your SAML resource that is placed on the webtop - I named it bobscloud.com for you. Essentially, you're forcing a user to automatically hit the webtop-based IDP-initiated connection without seeing the webtop.

Hi

I have exactly the same requirements. I will test the irule on the webtop also and post findings :)

@Rabbit23 or @blwavg did either of you get this working? I have a couple functional virtual servers / access policies for SP-initiated but am not sure how to set up IdP initiated.

I did get it to work, one thing to be aware of is that the webtop does not allow cookie persistence. So if you want to avoid signing into your IDP when the SP session expires this is not an option for IDP initiated SSO.

So basically, create your webtop and in your access policy just before the allow event add advanced resource assign and assign the webtop to the access policy. Then you will find after logon you should get the webtop with the SAML resource(s) you published to the webtop.

Click on one of the links and this should take you through to your cloud service. Note this link will be similar to Michael Kofman's example above, which is which you simply add to an irule which means the user will never actually see the webtop but go to the service provider.

Let me know how it pans out.

I was not able to get the F5 to work as an IDP. So I was not able to test either scenario.

Has anyone gotten cookie persistence to work with IDP initiated and when using a webtop. I can't get this to work!

Irule: log local0.notice "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Policy Completed" switch -glob [ACCESS::session data get session.server.network.name] { "recruitment.company.com" { log local0.notice "recruitment: Policy Completed" ACCESS::respond "/saml/idp/res?id=/SSO/recruitment" ACCESS::respond 302 Location "/saml/idp/res?id=/Common/bobscloud.com" } "bluetube.company.com" { log local0.notice "recruitment: Policy Completed" ACCESS::respond "/saml/idp/res?id=/SSO/Kaltura" ACCESS::respond 302 Location "/saml/idp/res?id=/Common/bobscloud.com" }

}