Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Clear all filters

Examining SAML claims for managing permissions

I'm designing a gateway for some legacy systems which cannot consume SAML. We have an STS which issues SAML tokens to end-user applications and these pass through the enterprise. It's a single STS, which will grant/refuse access to lower sub-systems by listing all the systems allowed within the list of authentication claims. For SAML-aware apps, this is easy. Each app validates the token and looks to see if its claim is present.

In order to access the legacy systems, I want to have an F5 look at the token and then allow/deny access to the back-end system based upon that claim. The service names will be different, but the same SAML token will be presented each time. Thus I think I need to a) validate the SAML token (easy) and then look to see whether it contains a claim that matches the target service.

I'm struggling to see how to do this elegantly, as the documentation on SAML and IRules seems a little thin in places.

Rate this Question
Comments on this Question
Comment made 22-Oct-2014 by R Eastman
Is the SAML "token" digitally signed? Is it via an https connection that isn't terminated on the F5?
Comment made 22-Oct-2014 by Kevin Grumball 76
Yes, the SAML token is digitally signed by the STS, which is independent of the F5, or any external HTTPS. If we used ADFS internally for this (and we might) then it would have the same issues. The F5 gateway will have the public key of the STSs, so that it can validate the SAML tokens.

Answers to this Question