single sign on

16 Topics

Dynamic , Variable RelayState in IdP initiated SAML SSO
I'm having difficulty finding a way to persist a RelayState for an IdP-initiated SSO with a vendor. Considering a link like the following: https://sso-myorganization.com?RelayState=12345 The Assertion Consumer service is set to: https://sso-myvendor.com.login.do This RelayState does not appear to append in the HTTP POST alongside the SAMLResponse value. Any thoughts on this? Perhaps the F5 doesn't support RelayState in an IdP initiated SAML SSO scenario? If we manually edit the "RelayState" value in the SP Connector setting screen with a proper value, it works, but it doesn't appear to be dynamic
Solved
AJ_01_135899
Sep 28, 2016 Place Technical Forum
1.5KViews
0likes
12Comments
SAML SLO fails
Configured BIGIP as IDP and ADFS plays the role of SP. SSO works as expected with no issues. When trying an SP initiated SLO from ADFS , an logout request is sent to BIGIP and in it return sends the Logout Resonse. But the status in the Logout Response is ** ** Verified the Signing certificates , SLO endpoints and bindings at both the IDP and SP. Still not able to find the issue ....
kbasa_279826
Aug 08, 2016 Place Technical Forum
699Views
0likes
4Comments
In 5 Minutes Video - Smart Connection with the BIG-IP Edge Client
Watch how the F5 Networks BIG-IP Edge Client solution gets you connected automatically when you boot/start up your computer along with seeing browser based access of the F5 BIG-IP Edge Gateway.
PSilva
Mar 11, 2010 Place Technical Articles
652Views
0likes
0Comments
Forms based SSO not working
I have a forms based sso profile, on an APM policy for an apache server, I cannot get sso to pass the username/credentials. Started with a basic forms based policy. Then contacted the vendor for a starting URI and username/password parameters, still not successful. Application login provides a username field, after entering the username the password field is displayed.
The-messenger
Apr 11, 2019 Place Technical Forum
399Views
0likes
3Comments
In 5 Minutes or Less Video - BIG-IP APM & Citrix XenApp
Watch how F5 customers can now simply use BIG-IP Access Policy Manager or BIG-IP Edge Gateway to consolidate access control in a central location, keeping infrastructure administration concerns to a minimum. With BIG-IP solutions, customers enjoy the flexibility and scalability needed to extend Citrix applications to both local and remote users without changing local XenApp deployments or requiring STA to provide secure remote access to applications. Highlights of deploying Citrix and F5 technologies together include: Reduced Management Time and OpEx – By simplifying and centralizing local and remote access authentication, BIG-IP solutions eliminate the need for customers to add separate Citrix STA infrastructure or make changes to existing Web Interface servers, resulting in an environment that is less expensive to deploy and requires less time to manage. Simplified Configuration and Deployment – With BIG-IP solutions, administrators can support users of Citrix applications with fewer devices, configure deployments to support flexible access models, and easily scale the environment. This fully integrated functionality makes it quick and easy for customers to set up and deploy local and remote access capabilities for Citrix applications, keeping users productive. Centralized and Comprehensive Access Control – Unlike the separate Citrix products required to adequately support applications for remote users, BIG-IP solutions provide centralized application access control and use a single access policy to support all types of users securely, so IT teams can be confident that application access is aligned with the organizations’ specific business priorities and security policies. &amp;amp;amplt;/p&amp;amp;ampgt; &amp;amp;amplt;p&amp;amp;ampgt;ps&amp;amp;amplt;/p&amp;amp;ampgt; &amp;amp;amplt;p&amp;amp;ampgt;Resources:&amp;amp;amplt;/p&amp;amp;ampgt; &amp;amp;amplt;ul&amp;amp;ampgt; &amp;amp;amplt;li&amp;amp;ampgt;&amp;amp;amplt;a href=&quot;http://www.f5.com/news-press-events/press/2010/20101214.html&quot; _fcksavedurl=&quot;http://www.f5.com/news-press-events/press/2010/20101214.html&quot;&amp;amp;ampgt;F5 Simplifies and Centralizes Access Management for Citrix Applications&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;/li&amp;amp;ampgt; &amp;amp;amplt;li&amp;amp;ampgt;&amp;amp;amplt;a href=&quot;downloads.f5.com&quot; _fcksavedurl=&quot;downloads.f5.com&quot;&amp;amp;ampgt;BIG-IP v10.2.1 Download (Log in required)&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;/li&amp;amp;ampgt; &amp;amp;amplt;li&amp;amp;ampgt;&amp;amp;amplt;a href=&quot;http://www.f5.com/products/big-ip/access-policy-manager.html&quot; _fcksavedurl=&quot;http://www.f5.com/products/big-ip/access-policy-manager.html&quot;&amp;amp;ampgt;BIG-IP Access Policy Manager&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;/li&amp;amp;ampgt; &amp;amp;amplt;li&amp;amp;ampgt;&amp;amp;amplt;a href=&quot;http://www.f5.com/products/big-ip/edge-gateway.html&quot; _fcksavedurl=&quot;http://www.f5.com/products/big-ip/edge-gateway.html&quot;&amp;amp;ampgt;BIG-IP Edge Gateway&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;/li&amp;amp;ampgt; &amp;amp;amplt;li&amp;amp;ampgt;&amp;amp;amplt;a href=&quot;https://www.youtube.com/user/f5networksinc&quot; _fcksavedurl=&quot;https://www.youtube.com/user/f5networksinc&quot;&amp;amp;ampgt;F5 YouTube Channel&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;/li&amp;amp;ampgt; &amp;amp;amplt;/ul&amp;amp;ampgt; &amp;amp;amplt;table border=&quot;0&quot; cellspacing=&quot;0&quot; cellpadding=&quot;2&quot; width=&quot;325&quot;&amp;amp;ampgt;&amp;amp;amplt;tbody&amp;amp;ampgt; &amp;amp;amplt;tr&amp;amp;ampgt; &amp;amp;amplt;td valign=&quot;top&quot; width=&quot;200&quot;&amp;amp;ampgt;Connect with Peter: &amp;amp;amplt;/td&amp;amp;ampgt; &amp;amp;amplt;td valign=&quot;top&quot; width=&quot;123&quot;&amp;amp;ampgt;Connect with F5: &amp;amp;amplt;/td&amp;amp;ampgt; &amp;amp;amplt;/tr&amp;amp;ampgt; &amp;amp;amplt;tr&amp;amp;ampgt; &amp;amp;amplt;td valign=&quot;top&quot; width=&quot;200&quot;&amp;amp;ampgt;&amp;amp;amplt;a href=&quot;http://www.linkedin.com/pub/peter-silva/0/412/77a&quot; _fcksavedurl=&quot;http://www.linkedin.com/pub/peter-silva/0/412/77a&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_linkedin[1]&quot; border=&quot;0&quot; alt=&quot;o_linkedin[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_linkedin.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_linkedin.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;https://devcentral.f5.com/s/weblogs/psilva/Rss.aspx&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/psilva/Rss.aspx&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_rss[1]&quot; border=&quot;0&quot; alt=&quot;o_rss[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_rss.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_rss.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;http://www.facebook.com/f5networksinc&quot; _fcksavedurl=&quot;http://www.facebook.com/f5networksinc&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_facebook[1]&quot; border=&quot;0&quot; alt=&quot;o_facebook[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_facebook.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_facebook.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;http://twitter.com/psilvas&quot; _fcksavedurl=&quot;http://twitter.com/psilvas&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_twitter[1]&quot; border=&quot;0&quot; alt=&quot;o_twitter[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_twitter.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_twitter.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;/td&amp;amp;ampgt; &amp;amp;amplt;td valign=&quot;top&quot; width=&quot;123&quot;&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;http://www.facebook.com/f5networksinc&quot; _fcksavedurl=&quot;http://www.facebook.com/f5networksinc&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_facebook[1]&quot; border=&quot;0&quot; alt=&quot;o_facebook[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_facebook.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_facebook.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;http://twitter.com/f5networks&quot; _fcksavedurl=&quot;http://twitter.com/f5networks&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_twitter[1]&quot; border=&quot;0&quot; alt=&quot;o_twitter[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_twitter.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_twitter.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;http://www.slideshare.net/f5dotcom/&quot; _fcksavedurl=&quot;http://www.slideshare.net/f5dotcom/&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_slideshare[1]&quot; border=&quot;0&quot; alt=&quot;o_slideshare[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_slideshare.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_slideshare.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt; &amp;amp;amplt;a href=&quot;https://www.youtube.com/f5networksinc&quot; _fcksavedurl=&quot;https://www.youtube.com/f5networksinc&quot;&amp;amp;ampgt;&amp;amp;amplt;img style=&quot;border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px&quot; title=&quot;o_youtube[1]&quot; border=&quot;0&quot; alt=&quot;o_youtube[1]&quot; src=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_youtube.png&quot; _fcksavedurl=&quot;https://devcentral.f5.com/s/weblogs/images/devcentral_f5_com/weblogs/macvittie/1086440/o_youtube.png&quot; width=&quot;24&quot; height=&quot;24&quot; /&amp;amp;ampgt;&amp;amp;amplt;/a&amp;amp;ampgt;&amp;amp;amplt;/td&amp;amp;ampgt; &amp;amp;amplt;/tr&amp;amp;ampgt; &amp;amp;amplt;/tbody&amp;amp;ampgt;&amp;amp;amplt;/table&amp;amp;ampgt; &amp;amp;amplt;p&amp;amp;ampgt;Technorati Tags: &amp;amp;amplt;a href=&quot;http://technorati.com/tags/F5&quot; _fcksavedurl=&quot;http://technorati.com/tags/F5&quot;&amp;amp;ampgt;F5&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/in+5+minutes&quot; _fcksavedurl=&quot;http://technorati.com/tags/in+5+minutes&quot;&amp;amp;ampgt;In 5 Minutes&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/integration&quot; _fcksavedurl=&quot;http://technorati.com/tags/integration&quot;&amp;amp;ampgt;integration&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/bigip&quot; _fcksavedurl=&quot;http://technorati.com/tags/bigip&quot;&amp;amp;ampgt;big-ip&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/Pete+Silva&quot; _fcksavedurl=&quot;http://technorati.com/tags/Pete+Silva&quot;&amp;amp;ampgt;Pete Silva&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/security&quot; _fcksavedurl=&quot;http://technorati.com/tags/security&quot;&amp;amp;ampgt;security&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tag/business&quot; _fcksavedurl=&quot;http://technorati.com/tag/business&quot;&amp;amp;ampgt;business&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tag/education&quot; _fcksavedurl=&quot;http://technorati.com/tag/education&quot;&amp;amp;ampgt;education&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tag/technology&quot; _fcksavedurl=&quot;http://technorati.com/tag/technology&quot;&amp;amp;ampgt;technology&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/application+delivery&quot; _fcksavedurl=&quot;http://technorati.com/tags/application+delivery&quot;&amp;amp;ampgt;application delivery&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/citrix&quot; _fcksavedurl=&quot;http://technorati.com/tags/citrix&quot;&amp;amp;ampgt;citrix&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/cloud&quot; _fcksavedurl=&quot;http://technorati.com/tags/cloud&quot;&amp;amp;ampgt;cloud&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/context-aware&quot; _fcksavedurl=&quot;http://technorati.com/tags/context-aware&quot;&amp;amp;ampgt;context-aware&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/xenapp&quot; _fcksavedurl=&quot;http://technorati.com/tags/xenapp&quot;&amp;amp;ampgt;xenapp&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/automation&quot; _fcksavedurl=&quot;http://technorati.com/tags/automation&quot;&amp;amp;ampgt;automation&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/web&quot; _fcksavedurl=&quot;http://technorati.com/tags/web&quot;&amp;amp;ampgt;web&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/video&quot; _fcksavedurl=&quot;http://technorati.com/tags/video&quot;&amp;amp;ampgt;video&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/blog&quot; _fcksavedurl=&quot;http://technorati.com/tags/blog&quot;&amp;amp;ampgt;blog&amp;amp;amplt;/a&amp;amp;ampgt;, &amp;amp;amplt;a href=&quot;http://technorati.com/tags/F5+APM&quot; _fcksavedurl=&quot;http://technorati.com/tags/F5+APM&quot;&amp;amp;ampgt;APM&amp;amp;amplt;/a&amp;amp;ampgt;&amp;amp;amplt;/p&amp;amp;ampgt;&amp;amp;amplt;/body&amp;amp;ampgt;&amp;amp;amplt;/html&amp;amp;ampgt; ps Resources: F5 Simplifies and Centralizes Access Management for Citrix Applications BIG-IP v10.2.1 Download (Log in required) BIG-IP Access Policy Manager BIG-IP Edge Gateway F5 YouTube Channel
PSilva
Jan 24, 2011 Place Technical Articles
385Views
0likes
2Comments
SSO with SAP BI ( APM )
Hello Team, I have a problem with SSO on SAP BI. My SAP APP have the same URL ( Form Action and Login ), and when i execute SSO its Failed. This is my Parameters and the wich contain form is the same URL that contain de login. So, in my sso_form, i config this. And in my logs, i see that aparently is working But i cannot make this work. Somebody can help me ?
LeonardoF5_1747
Jan 20, 2017 Place Technical Forum
316Views
0likes
1Comment
Error on the login page for SSO
Configured APM as Identity Provider , following the document https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-saml-config-guide-11-3-0/3.html When i initiate the SSO from the SP application , it gets redirected to the APM but with an error. i do not see a login screen , instead this error Object not found! The requested URL was not found on this server. If you entered the URL manually please check your spelling and try again.Error 404 it gets redirected to the url : https://apm.mingledev.com/saml/idp/profile/redirectorpost/sso?SAMLRequest=fZJBS8QwEIX%2fSsm9Tdq...&RelayState=3e00dc15-dd56-... Where can i find the logs to see more information about this error.? or can anyone tell me if i am missing something here....
kbasa_279826
Jul 27, 2016 Place Technical Forum
299Views
0likes
2Comments
Need help with Client-Initiated Form SSO
Standard forms-based SSO doesn't work with a home-grown web app I am trying to get SSO working for. I've read through the manual page for APM for client-initiated forms. Following that manual I still can't get it to work. Below is the sequence for the web page on how you get to the POST of the forms. 1) GET 2) Response is a 302 to 3) The GET to results in a 302 to dynamic string here" 4) POST to dynamic string here" with forms for redirectUrl (blank value), userName, and password. Below is my current config. I can't find a way to include the redirectUrl form parameter with a blank value. I'm not certain that is why it isn't working. I think that, combined with I don't know how to set this up to capture that dynamic string and pass that through as part of the request-value, is why it isn't working. As usual any help is much appreciated. My testing indicates that including that dynamic string is necessary. forms { FormProfileName { controls { password { secure true value "%{session.sso.token.last.password}" } userName { secure true value "%{session.sso.token.last.username}" } } request-value https://www.webapp.org/abc/portal/connect/home/login/ success-match-type url success-match-value /abc/myportal/connect/home/word/* } }
Steve_245
Feb 09, 2017 Place Technical Forum
257Views
0likes
0Comments
APM SSO for different domain joined machines?
I have a scenario and I THINK it may be caused by below issue. I have an app, let's call it MYAPP, which is integrated with F5 APM for SSO using basic/kerberos auth. THe F5 is setup to use a specific domain, let's call it mydomain.com. A machine that is either domain joined to mydomain.com can login to my application fine using 3 major browsers (IE, Chrome and Firefox). When the machine is NOT domain joined, browser will prompt for credentials in all 3 browsers, then log user in fine. What I have noticed is that if a user tries to login using a machine that is joined to a DIFFERENT domain, in Internet Explorer/Chrome, the user will receive the login prompt (as kerberos should fail) but APM denies them access even when they type their username as "mydomain\user". The only exception is Firefox, which allows the user to enter their credentials and still sign in. My question is: 1. Why does this occur? 2. What is the fix? Is there an F5 side fix? Is there a client side fix? Thanks all!!
Steve_Falzon_17
Oct 06, 2017 Place Technical Forum
251Views
0likes
0Comments
Configuring Active Directory authentication
Hello , Need some help Setting up F5 SSO Solution , in this scenario F5 to act as an Identity Provider. Following the SSO document https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-saml-config-guide-11-3-0/3.html Stuck at the point Configuring an access policy to provide authentication from the local IdP Willing to use Active Directory Authentication Configuring an access policy to provide authentication from the local IdPConfigure an access policy so that this BIG-IP systems (as an IdP) can provide authentication for SAML service providers. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens. In the Access Policy column, click the Edit link for the access profile you want to configure to launch the visual policy editor. The visual policy editor opens the access policy in a separate screen. Click the (+) sign anywhere in the access policy to add a new action item. An Add Item screen opens, listing Predefined Actions that are grouped by General Purpose, Authentication, and so on. I do not see an EDIT option here at the Access Profiles , attached is the screen capture Just wondering what i missed here... Any help is greatly appreciated..!!!
kbasa_279826
Jul 26, 2016 Place Technical Forum
247Views
0likes
2Comments