F5 APM SAML SSO

[Stanislas_Piron]

Hi,

I am deploying a POC with F5 APM as reverse proxy and I have to publish internal resources configure with SAML auth.

I did not find any configuration how to configure it.

when I try to configure SAML SSO (in SSO menu, not SAML one), it create local IdP.

I do not want to create a SAML IdP but to authenticate user against existing SAML IdP.

Is it supported or have I to request customer to change internal authentication method?

Regards,

Stanislas

[FI_2016_187929]

Are you trying to configure F5 APM as the Service Provider? You can configure this by Access Policy - SAML - BIG-IP as SP.

This article provides more information: https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-o...

[Stanislas_Piro2]

Hi,

No, internal server (URL : ) is already configured with SAML auth with ADFS.

I now have to configure APM authentication (URL : https://myapp.comany.com, with ADFS auth too), then request a SAML token to ADFS for internal resource (URL : )

[KeesvandenBos]

Hi Stanislas,

Did you manage to figure out if SSO SAML is working as expected?? (so APM is requesting SAML token an behave of an authenticated user for a SP)

Cheers,

Kees

[Stanislas_Piro2]

Hi,

No, the customer changed the authentication method on the internal server from SAML to kerberos..

So Now users authenticate with SAML on APM and SSO is set to kerberos.

[KeesvandenBos]

Hi,

That is unfortunate. My customer has a sharepoint site behind a APM with user/pw login on the APM where the sharepoint site does saml auth. When the access session time's out and a different user uses the browser (without closing it) they are authenticated in sharepoint as the previous user. (with the sharepoint auth cookie) (APM is not aware of the SAML auth to sharepoint)

Kees

[Stanislas_Piro2]

Hi,

to remove previous session cookie, you can use this code (change the sharepoint cookie name):

when ACCESS_SESSION_STARTED { if { [HTTP::cookie exists sharepointcookie] } { ACCESS::session data set session.server.landinguri "/vdesk/cleanupCookie?url=[b64encode [ACCESS::session data get session.server.landinguri]]" } } when ACCESS_ACL_ALLOWED { switch -glob [string tolower [HTTP::path]] { "/vdesk/cleanupCookie" { ACCESS::respond 302 noserver Location [b64decode [URI::query [HTTP::uri] url]] "Set-Cookie" "sharepointcookie=deleted; expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;secure" } } }

[KeesvandenBos]

Thanx,

But I have one other question about is, there are two or more authenticated websites behind the same access policy, how can I do the same trick for all of them?

Cheers,

Kees