# SAML configuration with LTM exposed app

**URL:** <https://community.f5.com/t/saml-configuration-with-ltm-exposed-app/52552>\
**Category:** Technical Forums\
**Tags:** big-ip, big-ip-access-policy-manager-apm, application-delivery\
**Created:** [November 20, 2019, 12:37pm UTC](https://community.f5.com/t/saml-configuration-with-ltm-exposed-app/52552 "2019-11-20T12:37:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Luca\_Comes](https://avatars.discourse-cdn.com/v4/letter/l/a88e4f/32.png) [@Luca\_Comes](https://community.f5.com/u/Luca_Comes)\
**Post date:** [November 20, 2019, 12:37pm UTC](https://community.f5.com/t/saml-configuration-with-ltm-exposed-app/52552/1 "2019-11-20T12:37:14Z")

</div>

Dear all,

I need to expose an internal web application from my BigIP but I don’t want to expose directly the application logon page. The developer said to me that it can support SAML so I was thinking to implement it on my F5. I don’t understand what is the best configuration I can use, do I need both IDP and SP configured on the BigIP? Because if I configure it only as IDP the users need to access the application homepage before being redirected to the IDP, am I wrong?

Thank you in advance

Luca

---

<div class="post-metadata">

**Author:** ![Dave\_W](https://avatars.discourse-cdn.com/v4/letter/d/67e7ee/32.png) [@Dave\_W](https://community.f5.com/u/Dave_W)\
**Post date:** [November 20, 2019, 3:47pm UTC](https://community.f5.com/t/saml-configuration-with-ltm-exposed-app/52552/2 "2019-11-20T15:47:55Z")

</div>

Hello Luca, this depends. In this use case it does sound like APM would be the SP. You could have the APM be both the IdP and SP (or use an external IdP). Regarding your last question, no, typically SAML can be SP or IdP initiated. So they could go to the App (SP) first or the IdP first.

Here is some more info:

[![](https://d20hrnpixdzcsd.cloudfront.net/original/3X/5/2/52b366f36086467e90d23af2c102027e6c4d7214.jpeg "Post of the Week: SAML IdP and SP on One BIG-IP") ](https://www.youtube.com/watch?v=WdRJZ5BnZug)

> **[Using APM as a SAML IdP SSO portal](https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-12-1-0/29.html)**

> **[Using APM as a SAML Service Provider](https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-0/30.html)**