APM as ADFS proxy in front of ADFS server 3.0 for O365

Problem this snippet solves:

When deploying APM as ADFS proxy in front of ADFS server, there are some issues :

• user agent different than Internet Explorer are redirected to ADFS form based authentication after APM auth
• Logout URI is not managed by APM. users disconnected from Office 365 are not disconnected from APM
• users who are still authenticated on O365 but with expired session on APM are prompted to authenticate on APM when disconnecting from O365
• When authentication fails, APM display logout page with redirect to /. when user authenticate next time, ADFS server respond with 404 error code.
• When User try to connect to access URI /, ADFS server respond with 404 error code.

This irule change the APM behavior to optimize user experience.

to solve HTTP error 404, user trying to access / or session denied are redirected to https://portal.office.com

Note : Next step is to extract SAML relay state from request and redirect dynamically 404 error to relay state instead of fixed URL.

How to use this snippet:

Enable this irule on the virtual server.

Code :

when ACCESS_ACL_ALLOWED {
    # Change user-Agent to Internet Explorer 11 User-Agent
    HTTP::header replace "User-Agent" "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko msie7"
    # If authenticated request matches ADFS SLO URI, close APM session and redirect to URI stored in query parameter "wreply"
    if { ([string tolower [HTTP::path]] equals "/adfs/ls/") && ([string tolower [URI::query [HTTP::uri] wa]] equals "wsignout1.0") } {
        set redirect_uri [URI::decode [URI::query [HTTP::uri] wreply]]
        ACCESS::session remove
        ACCESS::respond 302 noserver Location $redirect_uri
        return
    }
}

when ACCESS_SESSION_STARTED {
    # If new session matches ADFS SLO URI, close APM session and redirect to URI stored in query parameter "wreply"
    set landinguri [ACCESS::session data get session.server.landinguri]
    if { ([string tolower $landinguri] starts_with "/adfs/ls/") && ([string tolower [URI::query $landinguri wa]] equals "wsignout1.0") } {
        set redirect_uri [URI::decode [URI::query $landinguri wreply]]
        ACCESS::respond 302 noserver Location $redirect_uri
        ACCESS::session remove
        return
    } elseif {!([string tolower $landinguri] starts_with "/adfs/")} {
        ACCESS::respond 302 noserver Location "https://portal.office.com"
        ACCESS::session remove
    }
}

when ACCESS_POLICY_COMPLETED {
    if { ([ACCESS::policy result] equals "deny") } {
        ACCESS::respond 302 noserver Location "https://portal.office.com"
        ACCESS::session remove
    } 
}

Tested this on version: