Is it possible to run an SAML IdP and one (or better: more) SPs on one VE?
I found a sentence in the doc: In a federation of BIG-IP-Systems, one BIG-IP System acts as a SAML Identity Provider and other BIG-IP systems act as SAML service providers.
Our environment isn't that demanding, so one VE-cluster could take the load easily.
The use case is as follows:
Now, I want to have a SAML resource on the SSO-portal for that load balancer for HTTPS.
Unsuccessful so far to get that one. AND not sure if that even can be done. ;)
Thanks in advance,
It is possible, I have done that many times in my lab. You need to be careful and configure you vs with different dns names to avoid get the browser to send the apm cookie it has for the Idp session when it access the Sp (the sp will be confused to see apm cookies for a session that is not started)
Keep in mind that you are doubling up the number of sessions in this deployment, one for the Idp and one for the Sp.
Thanks Daniel :)
If I'm getting this right, I'd need 3 VSs in this scenario:
idp.lab (fed by the AD),
portal.lab (the SSO APM), and
ox-lb.lab (the load balancer)
The number of sessions you are mentioning are probably a licensing and maybe a performance issue, right?
If I have understood you well, you should be able to apply the SP access profile to ox-lb.lab virtual server.
We got a Lightboard Post of the Week for this!
BTW this will only work if you're not using HTTP artifact binding with SAML2.0.
Having said that you can still configure artifact resolution service if you use HTTP for your VSs. That will come in handy if you just want to lab test, but not for production use for obvious reasons.
[Artifact resolution service] https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-6-0/27.html