SP-Initated SAML redirects to webtop?

Hard to say, but most likely there is a mismatch on the SAML configuration side somewhere - maybe SP, maybe the IDP.

For starters, since you say that you have two SPs, I suggest performing HTTPWatch or similar and checking if the URLs that SPs use to initiate the connection to the IDP are identical - if not, you might have a configuration mismatch on the SP side.

Start by checking that first. You can also enable SSO debug log and see if there are any notices/errors reported there

Hard to say, but most likely there is a mismatch on the SAML configuration side somewhere - maybe SP, maybe the IDP.

For starters, since you say that you have two SPs, I suggest performing HTTPWatch or similar and checking if the URLs that SPs use to initiate the connection to the IDP are identical - if not, you might have a configuration mismatch on the SP side.

Start by checking that first. You can also enable SSO debug log and see if there are any notices/errors reported there

Hi, to use IDP initiated SAML, you created 2 idp profiles? one for each sp.

the SP initiated SAML use idp as SSO profile. as you have 2 IDP depending on the SP requesting, you need to assign with an irule a different so for the second ressource.

you can see how to change so profile here

Hi,

ACCESS_ACL_ALLOWED Évent raise when user request is allowed by apm.

It raise just after HTTP_REQUEST When user is authenticated.

On the last irule, the condition is not referrer but the host name...

If the host name is the same for both IDP, you can filter on HTTP::path instead of HTTP::host

"For resource2, the login process appears to POST to http://login.company.com/my.policy"

Can you re-configure resource 2 to issue a post to the correct URL? It seems like the meta-data that you have configured i resource 2 is incorrect. Maybe it is only referencing the root url and not the SAML redirect URL?

I somewhat stumbled across the solution, it was the login URL that was set for the second resource.

When we started the setup, they asked for the login URL, which I assumed was https://login.company.com/idp/resource2 since that was the IDP Entity ID. It wasn't until I compared the metadata from my IDPs and the working service provider, that I realized it should have been https://login.company.com/saml/idp/profile/redirectorpost/sso.

Once the SP updated their system to use the new URL, everything worked great. Though I am somewhat surprised it was this hard to get working. Is it normal for people to need to sniff transactions and reverse-engineer packet captures to make this work?