I would like to have an idp for a multiple SP (Sp1, and SP2) . The connection is SP initiated to the idp.
For security reasons SP1 and SP2 need diferents policies to verify the user..
Instead of create differents idp, we would like ( if it's possible ) to make diferents branches on the policy based on the SAML autentication request like ProviderName or AssertionConsumerServiceURL.
I dont' know exactly how to write the irule and how to get the variables from the SAML request.
THe idea could be.
VS ( idp ) ==> { ACL irule } if ( AssertionConsumerServiceURL = SP1 ) ==> polici for SP1
if ( AssertionConsumerServiceURL = SP2 ) ==> polici for SP2
Is APM acting as IDP, and SPs are external to it? Can you please elaborate/post more details on what the different policies you want/need to follow to verify the user?
App1: url: app1.provider.com ==> Very confidential APP. Need a SAML tiquet with atribute "security level = hight"
App2: url: app2.provider.com ==> Very low confidencial APP. Need a SAML tiquet with atribute "security level = low"
...
Both need a saml tiquet, and both redirects to the same idp to obtain it, but on the policy of the F5 when the PrivederName= APP1 the policy would request 2 factor autentication . On the other hand, when the idp detects that the providename = APP2, only with username or password is enought.
This is the reason why we need to branch the policy on the idp based on SAML request PrivederName.
App1: url: app1.provider.com ==> Very confidential APP. Need a SAML tiquet with atribute "security level = hight"
App2: url: app2.provider.com ==> Very low confidencial APP. Need a SAML tiquet with atribute "security level = low"
...
Both need a saml tiquet, and both redirects to the same idp to obtain it, but on the policy of the F5 when the PrivederName= APP1 the policy would request 2 factor autentication . On the other hand, when the idp detects that the providename = APP2, only with username or password is enought.
This is the reason why we need to branch the policy on the idp based on SAML request PrivederName.
