F5 APM with specific not all SAML SP initiated connection issue, cause iRule execution fail, TCP reset with F5 Version 12.1.2 HF1

Hi,

can you post you irule so that we can check it?

Hi Daniel, Thanks for looking into this. Below is the iRule applied.

when RULE_INIT { Change to "1" to enable debugging log statements, 0 to disable set static::debug_IDP 1 }

when HTTP_REQUEST priority 30 { log local0. "HTTP Path= [HTTP::path]" log local0. "Access policy result= [ACCESS::policy result]" if {"[ACCESS::policy result]" eq "allow"} { switch -glob [string tolower [HTTP::path]] { "/staples*" { if { $static::debug_IDP } { log local0. "HTTP_REQUEST: Setting SAML start uri to staples" } HTTP::respond 302 Location "/saml/idp/res?id=/Common/Staples_IDP" return }

    "/concur*"
        {
            if { $static::debug_IDP } { log local0. "HTTP_REQUEST: Setting SAML start uri to concur" }
            HTTP::respond 302 Location "/saml/idp/res?id=/Common/Concur_IDP"
            return
        }

            "/healthfitness*"
        {
            if { $static::debug_IDP } { log local0. "HTTP_REQUEST: Setting SAML start uri to healthfitness" }
            HTTP::respond 302 Location "/saml/idp/res?id=/Common/HealthFitness_IDP"
            return
     }  
    }   
}

}

when ACCESS_POLICY_COMPLETED priority 30 { switch -glob [string tolower [ACCESS::session data get session.server.landinguri]] { "/staples*" { if { $static::debug_IDP } { log local0. "ACCESS_POLICY_COMPLETED: Setting SAML start uri to staples" } ACCESS::respond 302 Location "/saml/idp/res?id=/Common/Staples_IDP" return }

            "/concur*"
        {
            if { $static::debug_IDP } { log local0. "ACCESS_POLICY_COMPLETED: Setting SAML start uri to concur" }
            ACCESS::respond 302 Location "/saml/idp/res?id=/Common/Concur_IDP" 
            return
        }
             "/healthfitness*"
        {
            if { $static::debug_IDP } { log local0. "ACCESS_POLICY_COMPLETED: Setting SAML start uri to healthfitness" }
            ACCESS::respond 302 Location "/saml/idp/res?id=/Common/HealthFitness_IDP" 
            return
        }
    }

}

Hi, This can cause you problems

when HTTP_REQUEST priority 30  {
log local0. "HTTP Path= [HTTP::path]"
log local0. "Access policy result= [ACCESS::policy result]"
            >>>>>>if {"[ACCESS::policy result]" eq "allow"}

You should specify the sessionid from the MHRSession when using ACCESS commands in HTTP_REQUEST events (in general out of ACCESS events) otherwise you will get an error. Other option for you is do the same validation but within ACCESS_ACL_ALLOWED as it takes by default the session id evaluated in that request.

I used more this command: ACCESS::session exists -state_{allow|deny|redirect|inprogress} -sid

Hi Daniel,

I have tried with the irule below but it is throwing error while try to initiate a session in both IDP initiated and SP initiated.

when RULE_INIT { Change to "1" to enable debugging log statements, 0 to disable set static::debug_IDP 1 }

when HTTP_REQUEST priority 30 { if { "[ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid]" } { switch -glob [string tolower [HTTP::path]] { "/staples*" { if { $static::debug_IDP } { log local0. "HTTP_REQUEST: Setting SAML start uri to staples" } HTTP::respond 302 Location "/saml/idp/res?id=/Common/Staples_IDP" return }

    "/concur*"
        {
            if { $static::debug_IDP } { log local0. "HTTP_REQUEST: Setting SAML start uri to concur" }
            HTTP::respond 302 Location "/saml/idp/res?id=/Common/Concur_IDP"
            return
        }

            "/healthfitness*"
        {
            if { $static::debug_IDP } { log local0. "HTTP_REQUEST: Setting SAML start uri to healthfitness" }
            HTTP::respond 302 Location "/saml/idp/res?id=/Common/HealthFitness_IDP"
            return
     }  
    }   
}

}

when ACCESS_POLICY_COMPLETED priority 30 { switch -glob [string tolower [ACCESS::session data get session.server.landinguri]] { "/staples*" { if { $static::debug_IDP } { log local0. "ACCESS_POLICY_COMPLETED: Setting SAML start uri to staples" } ACCESS::respond 302 Location "/saml/idp/res?id=/Common/Staples_IDP" return }

            "/concur*"
        {
            if { $static::debug_IDP } { log local0. "ACCESS_POLICY_COMPLETED: Setting SAML start uri to concur" }
            ACCESS::respond 302 Location "/saml/idp/res?id=/Common/Concur_IDP" 
            return
        }
             "/healthfitness*"
        {
            if { $static::debug_IDP } { log local0. "ACCESS_POLICY_COMPLETED: Setting SAML start uri to healthfitness" }
            ACCESS::respond 302 Location "/saml/idp/res?id=/Common/HealthFitness_IDP" 
            return
        }
    }

}

Error:

Jul 6 08:44:51 slot1/FDYEXLB01 err tmm[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm1[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm1[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm2[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:51 slot1/FDYEXLB01 err tmm2[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:52 slot1/FDYEXLB01 err tmm3[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid" Jul 6 08:44:52 slot1/FDYEXLB01 err tmm2[22774]: 01220001:3: TCL error: /Common/SAML_IDP_V4 - wrong args: should be "ACCESS::session exists [ -state_allow | -state_deny | -state_redirect | -state_inprogress ] [[-sid] ] " while executing "ACCESS::session exists -{state_allow|-state_deny|-state_redirect|-state_inprogress} -sid"

Please let me know if I missed something. Please help here and also make sure that existing iRule is working for all IDP initiated and SP initiated except only one SP initiated connection getting drop due to the iRule

Hi Jitu,

You need to use either state_allow or state_deny or state_redirect. You should not use all in one.

Example

when HTTP_REQUEST priority 30 { set apm_cookie [HTTP::cookie value MRHSession] if { "[ACCESS::session exists -state_allow -sid $apm_cookie]" } {

Great advise Nag !! really appreciated. Now my SAML stuffs are working both SP initiated and IDP initiated.

I have removed the if {"[ACCESS::policy result]" eq "allow"} { by

set apm_cookie [HTTP::cookie value MRHSession] if { "[ACCESS::session exists -state_allow -sid $apm_cookie]" } {

Glad to hear that it works Jitu.

Hi Jitu, glad it works! Sorry I just paste the command as it shows in the API documentation.

Cheers

Thanks all of you !! have a great day.