For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Michael_Koyfman's avatar
Michael_Koyfman
Icon for Cirrocumulus rankCirrocumulus
Nov 12, 2013

It is definitely possible, but you'd need to use an iRule for that. 

when ACCESS_POLICY_COMPLETED {

            log local0. "Policy Completed"
            switch -glob [ACCESS::session data get session.server.network.name] {
                            "bobscloud.company.comp"
                                            {
                                                                                                                           ACCESS::respond 302 Location "/saml/idp/res?id=/Common/bobscloud.com"
                                            }
                            }

}

The value you put in the ACCESS::respond should match the name of your SAML resource that is placed on the webtop - I named it bobscloud.com for you. Essentially, you're forcing a user to automatically hit the webtop-based IDP-initiated connection without seeing the webtop.

  • blwavg_10621's avatar
    blwavg_10621
    Icon for Nimbostratus rankNimbostratus
    Nov 12, 2013
    I will test this out this week and let you know if it works. That is pretty clever. Thank you. I have some questions about the logic and flow of the data. But I want to play around a bit first and see if I can wrap my head around it first.
  • AP_129594's avatar
    AP_129594
    Icon for Nimbostratus rankNimbostratus
    Apr 04, 2014
    Do you add this as an iRules Event on the visual editor or iRules under VIP?
  • Michael_Koyfman's avatar
    Michael_Koyfman
    Icon for Cirrocumulus rankCirrocumulus
    Apr 08, 2014
    iRules under VIP
  • CDG's avatar
    CDG
    Icon for Nimbostratus rankNimbostratus
    Jan 20, 2016
    If I have an IpP with 2 SP, Is it possible to have mutiple SAML resources on the webtop and then use this type of iRule to redirect the users automaticaly to a specific webtop ressource?
  • InnO's avatar
    InnO
    Icon for Nimbostratus rankNimbostratus
    Oct 07, 2016

    Yes. I have one IdP with multiple cloud SP external connectors. I always create a specific endpoint IdP URI for each SP, then in my iRule, select my SAML resource to use in the ACCESS::respond based on the URI used to reach my IdP.

    For instance, for an IdP-initiated session for the MyCloudApp, I would configure and use a specific URI for my IdP named https://idp.mycompany.com/mycloudapp

    when ACCESS_POLICY_COMPLETED { 
    switch -glob [ACCESS::session data get session.server.landinguri] {
        "/mycloudapp*" {
        ACCESS::respond 302 Location "https://idp.mycompany.com/saml/idp/res?id=/Common/MYCLOUDAPP"
        }
        "/proofpoint*" {
        ACCESS::respond 302 Location "https://idp.mycompany.com/saml/idp/res?id=/Common/PROOFPOINT"
        }
        "/businessolver*" {
        ACCESS::respond 302 Location "https://idp.mycompany.com/saml/idp/res?id=/Common/BUSINESSOLVER"
        }
   }