APM in clientless mode, support for SAML

Hi,

maybe this link can be contain useful information for you about the clientless SAML authentication. It is not directly supported, so a little workaround is needed.

https://devcentral.f5.com/questions/clientless-sso

G.

Hi,

Thanks for the answer, but this iRule retrieves the username/password without using SAML. The problem with SAML is that is using redirects between the SAML SP and the SAML IdP. In this case, redirects are not supported and not allowed. The problem remains, how to solve this via an iRule?

Thierry

This would be difficult to achieve in the absence of redirects, if for no other reason than the SAML web sso passive protocol actually defines this as a requirement. The client must contact the IdP to authenticate. You could use SAML artifact mode to actually retrieve the assertion, but the client still needs to communicate with both parties. An alternative approach might be to have an iRule in front of the SP (a layered LTM VIP) actually perform the IdP logon request on behalf of the user (via sideband communication). The iRule would look something like this:

1. Collect credentials from initial user request.
2. Catch the SP's SAMLRequest response message and forward it to APM IdP (also in clientless-mode). Send the user's credentials as HTTP headers.
3. At the IdP, an iRule would collect the credential headers and insert these into the access policy for authentication. The IdP would then respond to the sideband request with an assertion message (actually a redirect with the SAMLResponse POST encoded within).
4. The LTM iRule would collect this, extract the SAMLResponse and then forward it to the SP VIP.

The above assumes APM IdP and SP, but you could use other varieties and customize the sideband messaging accordingly. Are the IdP and SP both APM in your case?

How can I send the client certificate via a sideband connection to the IdP?

You'd send data from the client certificate (ex. subject, upn, issuer, etc.) as HTTP headers to the IdP, which also has an iRule applied that will scoop these up and insert into its access policy.