APM SAML IdP - SP Issuer Extraction

Problem this snippet solves:

APM doesn't expose any detail about the SAML SP Issuer when authentication requests hitting APM as an IdP during an SP initiated SAMLRequest. This iRule when applied to a SAML IdP enabled virtual server will extract the assertion request, decode it and present the SAML SP Issuer ID as the session variable %{session.saml.request.issuer} within APM.

How to use this snippet:

This comes in real handy when performing authorisation of the resource and could help avoid having APM perform a TCP connection reset when a SAML resource isn't authorised.

Code :

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}
when HTTP_REQUEST {
if { [HTTP::path] equals "/saml/idp/profile/redirectorpost/sso" } {
if { [HTTP::method] equals "POST" } {
# Colelct POST data
set content_length [HTTP::header value Content-Length]
HTTP::collect $content_length
} elseif { [HTTP::method] equals "GET" } {
#TODO
}
}
}
when HTTP_REQUEST_DATA {

set payload_data [URI::decode [HTTP::payload]]

    log local0. "payload=[URI::query "?$payload_data" "SAMLRequest"]" 
if { $payload_data contains "SAMLRequest" } {
# Extract SAML request data
set SAMLdata [b64decode [URI::query "?$payload_data" "SAMLRequest"]]

set SAML_Issuer_loc [string first "saml:issuer" [string tolower $SAMLdata]]
set SAML_Issuer_start [expr {[string first ">" $SAMLdata $SAML_Issuer_loc] + 1}]
set SAML_Issuer_end [expr {[string first "<" $SAMLdata $SAML_Issuer_start] - 1}]
set SAML_Issuer [string range $SAMLdata $SAML_Issuer_start $SAML_Issuer_end]

if { !([ACCESS::session sid] equals "" ) } {
ACCESS::session data set session.saml.request.issuer $SAML_Issuer
}
}

}
when ACCESS_SESSION_STARTED {
if { [info exists SAML_Issuer] } {
ACCESS::session data set session.saml.request.issuer $SAML_Issuer
}
}

Tested this on version: