F5 APM and external authentication

but there are so few sites that supports begin a SAML IdP as of now

I would entirely disagree here. The "SAMLP" (SAML 2.0) protocol is very widely used. It is available through social media vendors (Google, Facebook, Salesforce, etc.), and through commercial and open source tools (Shibboleth, MS ADFS, Azure ACS, RadiantLogic, OpenAM, etc.). The only real hold-outs that I've come across are SharePoint and other applications that rely solely on WIF (Windows Identity Framework). In many of the above cases, APM SAML can be used as the IdP or the SP. To interact with SharePoint, you just need an ADFS in the environment, as the local "STS-RP", for protocol transformation.

As for Azure (as IdP), APM SAML currently only supports SHA-1 for signing, and ACS defaults to SHA-256. I'm not really sure how to change that in ACS, and the update for SHA-256 in APM is coming soon (so Ive heard).

You are correct, most of the social media vendors support SAML for access to their own applications (using a third-party IdP). You can use APM SAML as an IdP for Google, Facebook, and Salesforce. As for the IdP itself, it really depends on where the users are.

I highly recommend this (free) book from Microsoft (A Guide to Claims-based Identity and Access Control, Second Edition) as an excellent primer:

http://www.microsoft.com/en-us/download/details.aspx?id=28362

It talks about using Azure ACS as a connector to Facebook and others (which do actually assert claims) for social media authentication. Here's another interesting stackoverflow post that points to API references for various "social login" options.

http://stackoverflow.com/questions/6235735/how-to-add-social-login-services-from-google-facebook-yahoo-etc-to-my-website

Now, to tie this all back to F5 APM, you still need a connector like ACS for protocol transformation, which then asserts a claim back to your APM SP, or optionally to your APM IdP as a relying party (for additional claims assertion) before forwarding to the SP.

Stig,

What exactly is your use case? You're stating that you want external users to authenticate to your site. Where are these users coming from? What is driving the need to federate external identities? If we understand your use case and need a little bit better, we can provide more accurate guidance here.

Stig,

What exactly is your use case? You're stating that you want external users to authenticate to your site. Where are these users coming from? What is driving the need to federate external identities? If we understand your use case and need a little bit better, we can provide more accurate guidance here.

For social media authentication, you need a third party connector like Azure ACS to be the "STS RP" in front of your SP/RP. There are other vendors that support multiple social media APIs, but I don't remember any off the top of my head other than Azure.