For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rabbit23_116296's avatar
Rabbit23_116296
Icon for Nimbostratus rankNimbostratus
Feb 11, 2014

I did get it to work, one thing to be aware of is that the webtop does not allow cookie persistence. So if you want to avoid signing into your IDP when the SP session expires this is not an option for IDP initiated SSO.

 

So basically, create your webtop and in your access policy just before the allow event add advanced resource assign and assign the webtop to the access policy. Then you will find after logon you should get the webtop with the SAML resource(s) you published to the webtop.

 

Click on one of the links and this should take you through to your cloud service. Note this link will be similar to Michael Kofman's example above, which is which you simply add to an irule which means the user will never actually see the webtop but go to the service provider.

 

Let me know how it pans out.

 

Micah_Haarbrink's avatar
Micah_Haarbrink
Icon for Nimbostratus rankNimbostratus
Feb 12, 2014
Is there something about the webtop that is required for IdP-initiated sessions? I have a couple SP-initiated SAML configs that work fine without a webtop. The only iRule I use for them is to establish the persistence of the cookie. They are basically "logon page -> AD auth -> Allow". You hit the service providers login page (a custom login page for us obviously), it kicks back to the F5, the F5 allows and the SAML exchange sends it back through to the service provider and we're in. I assumed that if I set up an access policy to just "logon page -> AD auth -> Allow" that the settings from the Service Provider that is bound to the IdP would get used and send me into the site in a similar manner (hit my own login page on the F5, authentication, SAML settings tell it to go to the SP which gets the POST that says the session is good). So is there something about the webtop that is required that I have to land on the webtop first and then the F5 does something additional when it sends me through to the SP?