APM Cookbook: AutoLaunch SAML Resources

If you setup SAML SLO (SAML Single LogOut) then it will log the user out of the APM. As an alternative, you can have the SAML SP send a logged out user to your apm with the URL https://myapmvirtualserver.ccompany.com/vdesk/hangup.php3 and the session will be terminated. Or you could just leave the APM session in place and redirect a logged out user to something else like your website.

If you have auto-login through something like NTLM or Kerberos, then when the user is logged out they may just get logged back in automatically depending on which method above is used, so in that case you might want to write an iRule that intercepts and redirects the user somewhere else after a logout or perhaps anytime the incoming referer header is the logout page of the app, that way they won't just go to /my.policy and then get sent along to the app again.

Thanks a bunch, Graham. The SP we are working with is able to redirect the user to another URL when they log out of the SP, so I will try just redirecting them to the hangup page in APM. I tested it (by spoofing the redirect) and seems to achieve what you stated. And yes, I am utilizing Kerberos to log the user in automatically, so that is exactly what is happening (/my.policy and logged back into the app).

 

For the iRule piece you are referencing, I assume one of the examples here is likely what I would need to do if I need to go that route.

 

[https://devcentral.f5.com/s/articles/irule-security-101-06-http-referer]

 

Yep, I haven't written an iRule that does this yet, but that's the first solution that comes to mind (assuming there's a good Referer header to key off) and you're going down the right path. You'd want to remove the session as well. https://clouddocs.f5.com/api/irules/ACCESS__session.html

 

Actually, in your case since you can control the redirect URL, maybe the simplest is to just choose something like /mycustomlogout and redirect them there, and then your iRule can just look for that instead of bothering with the Referer header.

 

Perhaps try this (untested).

 

when HTTP_REQUEST {
    if { [HTTP::uri] equals "/mycustomlogout"} {
        ACCESS::session remove
        HTTP::redirect "https://mywebsite.com"
    }
}

Much appreciated, Graham!

Hello. How does that irule handle the SP-Initiated case?. I mean, when the VS receives a SP initiated session (https://sss.sss.com/saml/idp/profile/redirectorpost/sso), how it knows what SAML resource to provide to that session?. Could it be launched without a webtop? Thank you!.

Juan,

You're in luck, that is already default behavior! In SP initiated the user is sent directly back to the SP with the assertion following policy completion (authentication), they do not see a webtop. It knows what SAML resource to use because it can match the incoming SP initiated authentication request up to the assigned SAML resources.

If you see a webtop when attempting SP initiated, but IdP initiated auth works when the user clicks the webtop link, then there is a misconfiguration at the SP. It's not the IdP configuration because it can successfully perform IdP initiated auth. The SP misconfiguration results in F5 not identifying the request as SP initiated authentication request, so it just shows the webtop. The most common cause is the SP is not redirecting the user to the correct URI (/saml/idp/profile/redirectorpost/sso) or the SAML AuthN request is malformed/not present.

Just for your information:

It is still the same behavior in v13.1.0.1.

-> "Note: A configuration that allows users to initiate connection from service providers (SPs) only"

So the iRule above is still needed...

I haven't done much research about this yet but here is what I will be looking into: Use APM as SP and IDP => replace ADFS/WAP Proxy. so configure an sp and and idp on the same bigip and bind them. create two policies (sp policy and idp policy); have two web apps webapp1.domain.com and webapp2.domain.com directed to the sp VS. no webtops no ressources. user puts webapp1.domain.com in his browser and hits the sp vs . sp vs redirects the to idp vs to do ldap auth. idp vs redirectes to the sp vs (webapp2.domain.com) with saml assertion. sp vs policy gets the username drom the saml assertion and does kerberos sso to webapp2.domain.com.

Is this possible with APM version 12 ?

I have already used APM as IDP with adfs and web application proxy to do kcd auth. but I want to get rid of adfs and webapplication proxy.

Thanks.

Yes. That will work.

You should probably pick one of the DNS names to be the one used by the SP in its SAML configuration (webapp1.domain.com or webapp2.domain.com). So no matter what name is used to get to the SP, the one you picked in the SAML config is the one the user will be returned to after auth at the IdP. An alternative option if you must have the user returned to the same DNS name is that you could detect the DNS name, branch in the APM config, and have a different SAML Auth object for each DNS name (and related config).

You'll want to reference the manual for APM as SP and APM as IdP specific to the version you run. There are two ways to deploy APM as IdP, with webtop and one without. With webtop is required if you'll have multiple SPs, but not if you will only have one and want to limit it to ONLY SP initiated auth (meaning you can't go to the IdP first). The article above is about how to deploy with webtop, but have the SAML object autolaunch so the user doesn't see the webtop, which is different.

This guide will help you on the Kerberos setup: https://f5.com/solutions/deployment-guides/kerberos-constrained-delegation-big-ip-v11-v12-apm

Note that it shows client cert auth on the client side and you're using SAML instead, but the setup of the Kerberos Constrained Delegation is the same.

If you need to seek more help, I suggest opening a new thread since this is out of scope for the article above and won't get the same level of notice/attention.

thanks Graham. I have an sp/idp config to play with now but I'm not getting the expected result. I will start another thread about this configuration. I will need several web applications using the same idp.