F5 SAML IdP - SP Initiated SSO for Unauthorized User Behavior

Forums Technical Forums
, ,
1

We’re using a Webtop to handle SP-Initiated and IdP-Initiated (Webtop Initiated) SAML SSO into multiple applications. Our access policy uses advanced resource assignment to assign specific SAML apps to specific users (AD Groups).

Unfortunately, if our users go to a SAML enabled website directly that they are unauthorized for, and performs an SP-Initiated login, the Access Policy allows them through, but doesn’t assign them the SAML App, which results in a connection reset error after the access policy is completed.

Here is our Access Policy:

image_204155.png
image_204155.png1073×212 13 KB

Is there a way to instead display an Unauthorized/Access Denied F5 page using the VPE? If so, how would I go about that since we are using advanced resource assignment?

2

I have the same issue and didn’t find a solution until now. Hope that somebody can help us.

3

I asked this same question to support two weeks back and an RFE has been opened as ID515539

4

Hi Guys,

Have a look at the variable session.server.landinguri in apm.

When an SP initiated request occurs, it should be hitting

Create a logic check in APM for the SP resource and gracefully deny the user and vice vera.

Hope that helps

Cheers Mike