Forum Discussion

Nifford's avatar
Nifford
Icon for Nimbostratus rankNimbostratus
Jan 25, 2016

Multiple F5 IdPs on One Access Profile w/IdP and SP-Initiated Logon

Here is my scenario:

 

I have multiple external SAML services that we need the F5s to function as an IdP for. The F5s need to support both IdP and SP initiated authentication to all of the external SAML services.

 

I've tried following the guide https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-2/29.html, but I'm not having any luck so far.

 

The only way I have been able to support IdP and SP initiated authentication to multiple servers is to associate each IdP's Entity ID to a unique hostname (ex. saml-salesforce.company.com/samlidp/salesforce, saml-webex.company.com/samlidp/webex) and then modify the access profile SSO configuration to multi-domain, associating each hostname with the corresponding SSO Config:

 

 

Is there a better/cleaner way to do this?

 

I've tried setting all the Entity IDs to the same hostname (ex. saml.company.com/samlidp/salesforce, saml.company.com/samlidp/webex), and changing the access profile domain mode to single domain. Every time I do, SP Initiated SSO fails for any configuration not selected under "SSO Configuration". If I select "None", all SP Initiated SSO fails.

 

Please let me know if you have any input, or if you have any further questions that I can answer.

 

APM
cloud
saml

3 Replies

Sort By
  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    Jan 25, 2016

    I think there is some confusion there. Have you seen this part of the documentation?

     

    https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-6-0/28.html

     

    If you want to support SP and IDP-initiated connections, then you need to create SAML Resource objects and assign them to the webtop. So, the best practice setup for you would be to create unique IDP object per each SP you have(the entity ID can be the same/redundant across all IDP configs), then bind each IDP and SP connector together, create SAML Resource object, and assign all SAML resource objects to the webtop.

     

    After that, you should have both SP and IDP-initiated logins work without issues - do not assign anything to the SSO at the Access Profile level in order for this work.

     

  • Nifford's avatar
    Nifford
    Icon for Nimbostratus rankNimbostratus
    Jan 26, 2016

    Right you are. I modified the configuration, and it is working as expected now. I believe I tried this before, but I must have had something assigned for SSO at the Access Profile level. Which explains why it didn't work the first time.

     

    Thanks for your time and input.