I have a SAML Resource set up on an APM webtop. The Virtual Server for the webtop is accessed at . This SAML Resource is an F5 IdP configuration that POSTs the SAML assertion to the ACS endpoint https://[publicIP]/wg/saml/SSO/index.html. I have an iRule attached the the Virtual Server that catches the /wg/saml/SSO/index.html and sends it to the pool of the SP. The problem is, when the SP gets the assertion, it sends a 302 redirect back to , and that triggers a new APM session.
I am wondering what I am doing wrong here. I don't have another public IP to assign to the SP so I am relying on the single Public IP and 1 Virtual Server. The other option I have tried is by setting up a Portal Access Resource, with a rewrite profile on the private IP of the SP. I am having issues with the SAML AuthN request and the SAML assertion in this setup as well, as they are looking for public IPs for both sides and I am having trouble getting the assertion to go back to the Portal Access Resource itself.
I am not currently. Is that something I should be doing? Again, I am having a hard time understanding how to direct traffic back to the Portal Access Resource itself. All of the documentation makes it seem like you just set up the IdP and attach it to the resource and you are good to go.
So the IdP is the BIG-IP and the webserver is the SP??
 
Create a vip targeting vip configuration youtube and based on the uri path send traffic to the correct backend vip. On one backend vip attach the IdP APM policy, on the other assign the load balancing pool.
 
You can use this article as an example for the configuration.
