session awareness saml sp

do you mean this session awareness feature: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-12-0-0/15.html

yes

i kinda wonder if that will work. from what i recall on session awareness is that ASM has to detect the login process, create a login page configuration for that. with a SP it will redirect to the IdP for the login process. the ASM might see the SAML assertion but not actual login.

my experience with that functionality is limit and the few times i tried the pages weren't create in just the right way for ASM to detect the login.

you can try following steps :

1. In HTTP_REQUEST, on SAML URL
   • parse the assertion to extract username (if existing)
   • Add HTTP header Authorization with username and a fake password
2. In ASM, create a login URL with Basic authentication
3. In HTTP_REQUEST_RELEASE
   • remove HTTP header Authorization

let us know if it works!