Export SAML Metadata
Working on setting up APM (11.4.1) as a SAML service provider to an External IdP. Got the External IdP connector setup fine. Got the Local SP Service setup and bound to External IdP. In trying to Export the Metadata for the Local Service Provider in APM, I hit the Export Metadata option, and regardless if I Sign Metadata or not when I hit the Download button, I get nothing. No file download prompt in the browser or notice as to where the XML file may have been placed. How do I actually export the SP metadata so I can setup the F5 Relying Party in the IdP? The manual simply says "APM downloads an XML file". OK what does that mean? Thanks
Limit SP metadata SLO xml tag to POST or REDIRECT..
So.. I´ve setup a sp in apm. The sp is configred to use post binding. But we have an issue with adfs, as the metadata we export for the sp contain both post and redirect.. the clients use redirect..and both post and redirect are present as endpoints in adfs. Is it standard for the metadata to contain both or is that a piece of config we missed? At the moment we´ve manually removed the redirect part of the xml to solve it, but would be nice to know if it´s a configuration mistake or if its default behaviour.
Using SAML AssertionConsumerServiceIndex and AttributeConsumingServiceIndex
How do I get the F5 APM to send the AssertionConsumerServiceIndex in place of AssertionConsumerServiceURL in a SAML AuthnRequest? Also for the AttributeConsumingServiceIndex how do I get the F5 APM to put this in the AuthnRequest. I already have the relevant metadata definitions.Searching and Filtering Objects by Metadata
I've been adding some metadata to the WIPs in our f5 GTMs, eg "metadata": [ { "name": "xxAppName", "persist": "true", "value": "Web Service" }, { "name": "xxAppOwner", "persist": "true", "value": "myGroup2" }, { "name": "xxAppSupport", "persist": "true", "value": "support_email@mydomain.com" }, { "name": "xxServiceName", "persist": "true", "value": "myService2" }, { "name": "xxWIPStatus", "persist": "true", "value": "active" } ], This is useful when I'm using Splunk or jq to parse the results, but what if I want to limit the scope of the returned data in the original request, analogous to a filter like "where xxAppSupport == support_email@mydomain.com?" Do any versions of iControl REST (and by extension, the SDK) support this? It'll be really useful when this effort extends to our LTMs. Thanks.Big-ip as SAML IdP: automate metadata import
Hi, I'm looking into using our Big-IP as SAML IdP. It all seems straight forward, however I seem to be missing a key option: the regular import of SP Metadata. We currently use a Shibboleth IdP 3.x This IdP downloads on a regular basis the metadata of our federations. (Belnet, eduGAIN) These federations are large. There are many SP, SP change all the time. Obviously I don't want to create all the SP from the Medata by hand. Or even automate it by tmsh, this seems to be a bad idea. Is there any way to do this? I've seen the option Idp Automation, unfortunately it seems to be only for when you use the Big-IP as SAML SP. Thanks VincentAdding/Removing Metadata to GTM Pool: Will This Impact Traffic?
I haven't seen any evidence of this in practice or in documentation, but I'd feel a lot better with some corroboration from you lovely people in DevCentral. I'd like to execute the following PUT request against a GTM server running iControlREST v12 (for each pool): curl -sk "https://[f5_server]/mgmt/tm/gtm/pool/a/[pool_name]" -H 'Content-Type: application/json' --user "[user]":"[password]" -X PUT -d '{"metadata": [{"name": "AppName","persist": "true","value": "Test_Value1"},{"name": "ServiceName","persist":"false","value":"Test_Value2"},{"name": "AppOwner","persist":"false","value":"Test_Value3"},{"name": "AppSupport","persist":"false","value":"Test_Value4"}]}' So far, so simple, but I'd like to ensure that this doesn't invoke or trigger something dramatic like a config reload or crash the server. No visible cause for panic here, right? N.b. there is no metadata for these pools at present; I'm aware that this is a "write" and not an "update" command, but that's okay. Thanks!