Hello Experts,
I am trying to create a SAML SSO. Below are the details
F5 is acting as IDP Google GSuite is acting as SP (we intent to use gmail, drive etc from google with Auth by F5 APM) When I try IDP initiated connection, i.e. Click on the SAML SSO link published in Webtop, I am getting an error from google, which says “The required response parameter RelayState was missing” I have not configured any relaystate parameter in F5 under SAML SP Connector configuration. (rather i dont know what to configure) I tried to search a lot but not getting a definitive working parameter to be used as relay state.
Anyone got that working, please let me know how we can get this working or what relay state parameter shall i use when using F5 as IDP and google as SP, and the connection is IDP initiated.
No Man, this guide is good, but relay state information is missing, I tried few stuff, but didnt work. looking for exact information for relay state for google apps/ google mail when gsuite is SP. this guide says, relaystate as none 
have a look at this devcentral post
 
Cheers,
 
Kees
 
Yes, one of my colleague helped me with this and this relay state works
https://www.google.com/a/uti.aucegypt.edu/ServiceLogin\?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1<mpl=default<mplcache=2&emr=1&osid=1
its Very sad that, none of the F5 or the google documents have this mentioned…
Can you let me know how you added this to the relay state ? Possibly share the irule sanitized of course?
Thanks so much for your comment on this.
This will really help me I have been banging my head for weeks trying to figure this out.
I have tried the layered VS approach and tried to append relay state as a header, I have tried to use a stream profile and re-write the payload, but I am still having difficulties.
I added this in APM config, Relay State, not under iRule. Let me know if any questions
Like here in this image
Thanks again for your comments to start the session to have to go to a specific URL ?
Or can I just go to accounts.google.com ?
It will be SP initiated, for e.g. Just go to Mail.google.com and then it will take you to APM policy
On the APM policy Virtual Server, we added the below irule to make the seamless opening of GMAIL, The location in this irule is the SAML resource for the GSUITE.
ltm rule /Common/Auto-Launch { when ACCESS_POLICY_COMPLETED { ACCESS::respond 302 Location “/saml/idp/res?id=/Common/idp.uti.app/idp.uti_UTI_saml_resource_sso” } when ACCESS_ACL_ALLOWED { ACCESS::respond 302 Location “/saml/idp/res?id=/Common/idp.uti.app/idp.uti_UTI_saml_resource_sso” }
great excellent to hear this.. Do mark my post as answer if you are satisfied with the answer 
