Forum Discussion

onnan_377965's avatar
onnan_377965
Icon for Nimbostratus rankNimbostratus
Nov 28, 2018

Access Policy branch rule for multiple SP on same virtual server?

Hi, I'm new to SAML in F5 Big-IP LTM and APM but I'm trying to accomplish something quite simple.

 

I want to have one and the same virtual server for all my SAML federations (easier to maintain). Right now I only have one idp for an external SP, but I'm trying to setup another.

 

How can I in the APM access policy redirect an incoming connection from a specific URI to a specific idP hosted on the F5?

 

Right now the access policy is quite simple:

 

Start > SAML Auth > Successfull (Allow) Fallback (Deny)

 

Should I use advanced resource assign based on landinguri? And how do I do that properly?

 

Regards

 

Robert

 

access policy
APM
application delivery
saml

2 Replies

Sort By
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Nov 28, 2018

    Hi,

    you must create an empty box with multiple branches... expression of SP sp1.company.com must be:

    expr { [mcget {session.server.network.name}] == "sp1.company.com" }

    on each branch, add a SAML auth box with dedicated SAML SP profile.

  • Abdessamad1's avatar
    Abdessamad1
    Icon for Cirrostratus rankCirrostratus
    Nov 28, 2018

    I guess your F5 setup is playing the role of an IdP, but you have multipe IdP objects and want to use them depending on the SP.

     

    In this case I would use an iRule that looks at the Referer header and select the correct IdP with the "WEBSSO::select" command.