F5 Logo MyF5
Search
  1. MyF5 Home
  2. BIG-IP Access Policy Manager: SAML Configuration
  3. BIG-IP System Federation for SP- and IdP-Initiated Connections
Manual Chapter : BIG-IP System Federation for SP- and IdP-Initiated Connections

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 15.0.1, 15.0.0
Manual Chapter

BIG-IP System Federation for SP- and IdP-Initiated Connections

Overview: Federating BIG-IP systems for SAML SSO (with an SSO portal)

In a federation of BIG-IP systems, one BIG-IP system acts as a SAML Identity Provider (IdP) and other BIG-IP systems act as SAML service providers.
This configuration supports:
  • Connections that initiate at the IdP or at SAML service providers.
  • Service providers that require different types of subject, attributes, and security settings for assertions.

About local IdP service

A
SAML IdP service
 is a type of single sign-on (SSO) authentication service in Access Policy Manager (APM). When you use a BIG-IP system as a SAML identity provider (IdP), a SAML IdP service provides SSO authentication for external SAML service providers (SPs). You must bind a SAML IdP service to SAML SP connectors, each of which specifies an external SP. APM responds to authentication requests from the service providers and produces assertions for them.

About SP connectors

A SAML service provider connector (an SP connector) specifies how a BIG-IP system, configured as a SAML Identity Provider (IdP), connects with an external service provider.

What are the available ways I can configure a SAML SP connector?

You can use one or more of these methods to configure SAML service provider (SP) connectors in Access Policy Manager.
  • From metadata - Obtain a metadata file from the vendor and import it into Access Policy Manager. The advantage to this method is that the vendor provides the majority of all required data, including certificates. You can complete the configuration by simply typing a unique name for the SP connector, a very few additional required fields, and browsing to and importing the file. Access Policy Manager then configures the SP connector.
  • From template - Use templates that Access Policy Manager provides for some vendors; for example, Google. The advantages to this method are that:
    • Most required data is included in the template
    • Additional required data is minimal. You can obtain it and certificates from the vendor
    After you select a template and type data into a few fields, Access Policy Manager configures the SP connector.
  • Custom - Obtain information from the vendor and type the settings into the Configuration utility. To use this method, you must also obtain certificates from the vendor and import them into the BIG-IP system. Use this method when a metadata file or a template for an SP connector is not available.

About local SP service

A SAML SP service is a type of AAA service in Access Policy Manager (APM ). It requests authentication from an external SAML Identity Provider (IdP) that is specified on APM in a SAML IdP connector. (You bind a SAML service provider (SP) service to one or more SAML IdP connectors.) APM requests authentication from an IdP and consumes assertions from it to allow access to resources behind APM.

About IdP connectors

An IdP connector specifies how a BIG-IP system, configured as a SAML service provider (SP), connects with an external SAML identity provider (IdP).

About methods for configuring SAML IdP connectors in APM

You can use one or more of these methods to configure SAML identity provider (IdP) connectors in Access Policy Manager (APM).
  • From metadata - Obtain a metadata file from the vendor and import it into APM. The advantage to this method is that the vendor provides all required data, including the certificate. You can complete the configuration by simply typing a unique name for the identity provider, and browsing to and importing the file. APM imports the certificate to the BIG-IP system and configures the SAML IdP connector.
  • From template - Use templates that APM provides for some vendors. The advantages to this method are that:
    • Most required data is included in the template. (Note that the certificate is not included.)
    • Additional required data is minimal and is available from the vendor.
    APM configures the SAML IdP connector. You must obtain a certificate from the vendor and import it into the BIG-IP system.
  • Custom - Research the identity provider requirements and type all settings into the Configuration utility. Use this method when a metadata file or a template for an identity provider is not available. APM configures the SAML IdP connector. You must obtain a certificate from the vendor and import it into the BIG-IP system.
  • IdP Automation - Provide files with cumulative IdP metadata on remote systems, then configure BIG-IP IdP automation to poll the files periodically and create IdP connectors and bind them to a specific service provider (SP) service.

Task summary for SAML federation with SSO portal

Setting up SAML federation for BIG-IP systems involves three major activities:
  • First, you set up one BIG-IP system as a SAML identity provider (IdP) system
  • Next, you set up one or more BIG-IP systems as a SAML service provider (SP)
  • Last, you go back to the IdP system and set up connectivity to the SP systems

Flowchart: BIG-IP system federation configuration with SSO portal

This flowchart illustrates the process for configuring BIG-IP systems in federation and providing an SSO portal.
Configuration flow for SAML federation of BIG-IP systems

Setting up a BIG-IP system as a SAML IdP

You log in to the BIG-IP system that you have selected to act as the SAML Identity Provider (IdP) so that you can configure elements that are required for SAML federation.
  1. Log on to the BIG-IP system that you have selected to act as the SAML IdP in a SAML federation of BIG-IP systems.

Creating a virtual server for a BIG-IP (as SAML IdP) system

Before you start this task, configure a client SSL profile and a server SSL profile if you are going to create an SSL virtual server.
Access Policy Manager supports using a non-SSL virtual server for the BIG-IP system configured as a SAML Identity Provider (IdP). However, we recommend using an SSL virtual server for security reasons. The following procedures include steps that are required for configuring an SSL virtual server, such as selecting client and server SSL profiles, and setting the service port to HTTPS.
Specify a host virtual server to use as the SAML IdP.
  1. On the Main tab, click
    Local Traffic
    Virtual Servers
    .
    The Virtual Server List screen opens.
  2. Click
    Create
    .
    The New Virtual Server screen opens.
  3. In the
    Name
     field, type a unique name for the virtual server.
  4. In the
    Destination Address
     field, type the IP address for a host virtual server.
    This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
  5. In the
    Service Port
     field, type
    443
     or select
    HTTPS
     from the list.
  6. For the
    HTTP Profile
     setting, verify that the default HTTP profile,
    http
    , is selected.
  7. For the
    SSL Profile (Client)
     setting, from the
    Available
     list, select the name of the Client SSL profile you previously created and move the name to the
    Selected
     list.
  8. For the
    SSL Profile (Server)
     setting, from the
    Available
     list, select the name of the Server SSL profile you previously created and move the name to the
    Selected
     list.
  9. Click
    Finished
    .
The virtual server for the BIG-IP system configured as an IdP now appears on the Virtual Server List. The virtual server destination is available for use in one or more SAML IdP service configurations.

Configuring an artifact resolution service for BIG-IP federation with SSO portal

Before you configure the artifact resolution service (ARS), you need to have configured a virtual server. That virtual server can be the same as one that is used for an SAML Identity Provider (IdP), or you can create an additional virtual server.
F5 recommends that the virtual server definition include a server SSL profile.
You configure an ARS so that a BIG-IP system that is configured as a SAML IdP can provide SAML artifacts in place of assertions. With ARS, the BIG-IP system can receive Artifact Resolve Requests (ARRQ) from service providers, and provide Artifact Resolve Responses (ARRP) for them. You can configure one or more ARS.
In a BIG-IP system federation configuration that supports an SSO portal, you must configure one IdP service for each Service Provider. However, you do not need to configure a separate ARS for each IdP service.
  1. On the Main tab, click
    Access
    Federation
    SAML Identity Provider
    Artifact Resolution Services
    .
  2. Click
    Create
    .
    The Create New SAML Artifact Resolution Service popup screen opens, showing general settings.
  3. In the
    Name
     field, type a name for the artifact resolution service.
  4. In the
    Description
     field, type a new description.
  5. Click
    Service Settings
    .
  6. From the
    Virtual Server
     list, select the virtual server that you created previously.
    ARS listens on the IP address and port configured on the virtual server.
  7. In the
    Artifact Validity (Seconds)
     field, type the number of seconds for which the artifact remains valid. The default is
    60
     seconds.
    The BIG-IP system deletes the artifact if the number of seconds exceeds the artifact validity number.
  8. For the
    Send Method
     setting, select the binding to use to send the artifact, either
    POST
     or
    Redirect
    .
  9. In the
    Host
     field, type the host name defined for the virtual server, for example
    ars.siterequest.com
    .
  10. In the
    Port
     field, type the port number defined in the virtual server. The default is
    443
    .
  11. Click
    Security Settings
    .
  12. To require that artifact resolution messages from an SP be signed, select the
    Sign Artifact Resolution Request
     check box.
  13. To use HTTP Basic authentication for artifact resolution request messages, in the
    User Name
     field, type a name for the artifact resolution service request and in the
    Password
     field, type a password.
    These credentials must be present in all Artifact Resolve Requests sent to this ARS.
  14. Click
    OK
    .
    The popup screen closes, leaving the Artifact Resolution Services list screen open.
The Artifact Resolution Service is ready for use.

Configuring a SAML IdP service for one SP connector

Configure a SAML Identity Provider (IdP) service for Access Policy Manager, as a SAML IdP, to provide single sign-on authentication for one SAML service provider (SP).
Configure one IdP service for each SAML service provider.
  1. On the Main tab, click
    Access
    Federation
    SAML Identity Provider
    .
    The Local IdP Services screen opens.
  2. Click
    Create
    .
    The Create New IdP Service popup screen displays.
  3. In the
    IdP Service Name
     field, type a unique name for the SAML IdP service.
    The maximum length of a single sign-on configuration, such as the SAML IdP service, is 225 characters, including the partition name.
  4. In the
    IdP Entity ID
     field, type a unique identifier for the IdP (this BIG-IP system).
    Typically, the ID is a URI that points to the BIG-IP virtual server that is going to act as a SAML IdP. If the entity ID is not a valid URL, the
    Host
     field is required.
    For example, type
    https://siterequest.com/idp
    , where the path points to the virtual server you use for BIG-IP system as a SAML IdP.
  5. If the
    IdP Entity ID
     field does not contain a valid URI, you must provide one in the IdP Name Settings area:
    1. From the
      Scheme
       list select
      https
       or
      http
      .
    2. In the
      Host
       field, type a host name.
      For example, type
      siterequest.com
       in the
      Host
       field.
  6. If you select
    SAML Profiles
     on the left pane, the
    Web Browser SSO
     check box is selected by default.
    At least one profile must be selected.
  7. To specify that this IdP use an artifact resolution service, click
    Endpoint Settings
     on the left pane and select a service from the
    Artifact Resolution Service
     list.
  8. On the left pane, select
    Assertion Settings
     and complete the settings that display:
    1. From the
      Assertion Subject Type
       list, select the type of subject for the IdP to authenticate.
    2. From the
      Assertion Subject Value
       list, select the name of a session variable.
      This variable,
      %{session.logon.last.username}
      , is generally applicable. Some session variables are applicable depending on the type of authentication that you use for your site.
    3. In the
      Authentication Context Class Reference
       field, select a URI reference.
      The URI reference identifies an authentication context class that describes an authentication context declaration.
    4. In the
      Assertion Validity (in seconds)
       field, type the number of seconds for which the assertion is valid.
    5. To encrypt the subject, select the
      Enable encryption of Subject
       check box.
      The
      Encryption Strength
       list becomes available.
    6. From the
      Encryption Strength
       list, select a value.
      Supported values are AES128, AES192, and AES256.
  9. On the left pane, select
    SAML Attributes
    , and for each attribute that you want to include in the attribute statement, repeat these substeps.
    1. Click
      Add
      .
      A Create New SAML Attribute popup screen displays.
    2. In the
      Name
       field, type a unique name for the attribute.
      Usually, the name is a fixed string, but it can be a session variable.
    3. To add a value to the attribute, click
      Add
      , type a value in the
      Value(s)
       field, and click
      Update
       to complete the addition.
      You can use a session variable for the value.
      This example shows using a fixed string for the name and a session variable for the value. Name:
      user_telephonenumber
       and value:
      %{session.ad.last.attr.telephoneNumber}
      .
      You can repeat this step to add multiple values for an attribute.
    4. To encrypt the values, select the
      Encrypt
       check box and select a value from the
      Type
       list.
      Supported values for type are AES128, AES192, and AES256.
    5. Click
      OK
      .
      The Create New SAML Attribute popup screen closes.
  10. Click
    Security Settings
     from the left pane.
    1. From the
      Signing Key
       list, select the key from the BIG-IP system store.
      None
       is selected by default.
    2. From the
      Signing Certificate
       list, select the certificate from the BIG-IP system store.
      When selected, the IdP (the BIG-IP system) publishes this certificate to the service provider so the service provider can verify the assertion.
      None
       is selected by default.
  11. Click
    OK
    .
    The popup screen closes. The new IdP service appears on the list.
Access Policy Manager (APM) creates a SAML IdP service. It is available to bind to an SP connector.

Exporting SAML IdP metadata from APM

You need to convey the SAML Identity Provider (IdP) metadata from Access Policy Manager (APM) to the external service providers that use the SAML IdP service. Exporting the IdP metadata for a SAML IdP service to a file provides you with the information that you need to do this.
  1. On the Main tab, click
    Access
    Federation
    SAML Identity Provider
    .
    The Local IdP Services screen opens.
  2. Select a SAML IdP service from the table and click
    Export Metadata
    .
    A popup screen opens, with
    No
     selected on the
    Sign Metadata
     list.
  3. For APM to sign the metadata, perform these steps:
    1. From the
      Sign Metadata
       list, select
      Yes
      .
    2. From the
      Signing Key
       list, select a key.
      APM uses the key to sign the metadata.
    3. From the
      Signature Verification Certificate
       list, select a certificate.
      APM exports the certificate to the metadata file. The system on which you import the metadata file can use the certificate to verify the metadata signature.
  4. Select
    OK
    .
    APM downloads an XML file.

Configuring a SAML resource and attaching a SAML IdP service

Configure a SAML resource to provide access to services on a SAML service provider when using Access Policy Manager (APM) as a SAML IdP.
Configure one SAML resource for each SAML IdP service that you have configured.
  1. On the Main tab, click
    Access
    Federation
    SAML Resources
    .
    The SAML Resources list screen opens.
  2. Click the
    Create
    button.
    The SAML Resource New Resource window opens
  3. In the
    Name
     field, type a unique name for the SAML resource.
  4. Do not clear the
    Publish on Webtop
     check box unless when you want to remove this resource from the webtop.
    When
    Publish on Webtop
     is selected, the SAML resource is displayed on a webtop where a user can initiate connection to an SP by clicking the icon. If you want users to initiate connection to this resource from an external SAML service provider only and do not want to show this resource on a webtop, clear the check box.
  5. In the Configuration area from the
    SSO Configuration
     list, select the SAML IdP service that is bound to the SAML SP connector with the resources you want.
  6. In the
    Customization Settings for English
     area in the
    Caption
     field, type a caption for this SAML resource.
  7. Click
    Finished
    .
    The SAML resource is created and associated with a SAML IdP service that is bound to one external service provider.

Setting up a BIG-IP system as a SAML service provider system

You log in once to each BIG-IP system that you have selected to act as a SAML service provider so that you can configure the elements on it that are required for federation with other BIG-IP systems, one of which functions as an SAML IdP.
  1. Log on to a BIG-IP system that you have selected to act as a SAML SP in a federation of BIG-IP systems.

Configuring an IdP connector from IdP metadata

Locate the SAML IdP metadata file that you exported from the BIG-IP system (as IdP). If the metadata file is signed, obtain the certificate also; import it into the BIG-IP system store on this device.
Import IdP metadata to create a SAML IdP connector on this BIG-IP system. The SAML IdP connector enables this BIG-IP system to connect and exchange information with the external BIG-IP system that acts as the IdP in the SAML federation.
  1. On the menu bar, expand
    SAML Service Provider
     and click
    External IdP Connectors
    .
    The External IdP Connectors screen displays.
  2. Select
    Create
    From Metadata
    .
    The Create New SAML IdP Connector screen opens.
  3. In the
    Select File
     field, browse to and select the metadata file for the IdP.
  4. In the
    Identity Provider Name
     field, type a unique name for the IdP.
  5. If the metadata is signed, select a certificate from the
    Select Signing Certificate
     list.
  6. Click
    OK
    .
    The file is uploaded, the SAML IdP connector is created, and the screen closes.
The SAML IdP connector is displayed on the SAML IdP Connectors list.

Creating a virtual server for a BIG-IP (as SAML SP) system

Before you start this task, configure a client SSL profile and a server SSL profile.
Access Policy Manager supports using a non-SSL virtual server for the BIG-IP system (as SP). However, we highly recommend using an SSL virtual server for security reasons. The following procedure includes steps that are required for configuring an SSL virtual server. These are: selecting client and server SSL profiles and setting the service port to HTTPS.
Specify a host virtual server to use as the SAML SP.
  1. On the Main tab, click
    Local Traffic
    Virtual Servers
    .
    The Virtual Server List screen opens.
  2. Click
    Create
    .
    The New Virtual Server screen opens.
  3. In the
    Name
     field, type a unique name for the virtual server.
  4. In the
    Destination Address
     field, type the IP address for a host virtual server.
    This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
  5. In the
    Service Port
     field, type
    443
     or select
    HTTPS
     from the list.
  6. For the
    HTTP Profile
     setting, verify that the default HTTP profile,
    http
    , is selected.
  7. For the
    SSL Profile (Client)
     setting, from the
    Available
     list, select the name of the Client SSL profile you previously created and move the name to the
    Selected
     list.
  8. For the
    SSL Profile (Server)
     setting, from the
    Available
     list, select the name of the Server SSL profile you previously created and move the name to the
    Selected
     list.
  9. Click
    Finished
    .
The virtual server for the BIG-IP system configured as an SP now appears on the Virtual Server List. The virtual server destination is available for use in a SAML SP service configuration.

Configuring a SAML SP service for federation

Configure a SAML service provider (SP) service for Access Policy Manager to provide AAA authentication, requesting authentication and receiving assertions from a SAML IdP.
  1. On the Main tab, click
    Access
    Federation
    SAML Service Provider
    .
    The Local SP Services screen displays.
  2. Click
    Create
    .
    The Create New SAML SP Service screen opens.
  3. In the
    Name
     field, type a unique name for the SAML SP service.
  4. In the
    Entity ID
     field, type a unique identifier for the service provider.
    Typically entity ID is a URI that points to the BIG-IP virtual server that is going to act as SAML SP. If the entity ID is not a valid URL, the
    Host
     field is required.
    For example, type
    https://bigip-sp
    , where
    https:/bigip-sp
     points to the virtual server you use for BIG-IP system as a SAML service provider.
  5. If the
    Entity ID
     field does not contain a valid URI, in the SP Name Settings area from the
    Scheme
     list, select
    https
     or
    http
     and in the
    Host
     field, type a host name.
    For example, type
    siterequest.com
     in the
    Host
     field.
  6. In the
    Relay State
     field, type a scheme, host, and path.
    This is a path is where this BIG-IP system redirects users after they are authenticated.
  7. For this service provider to request an artifact instead of an assertion from the IdP, from the left pane select
    Endpoint Settings
     and, from the
    Assertion Consumer Service Binding
     list, select
    Artifact
    .
    POST
     is the default setting.
  8. From the left pane, select
    Security Settings
    .
    The screen displays the applicable settings.
  9. If you want this BIG-IP system to send signed authentication requests to the SAML IdP, select
    Signed Authentication Request
    . Then select a key and a certificate from those in the BIG-IP system store from the
    Message Signing Private Key
     and
    Message Signing Certificate
     lists.
  10. If this BIG-IP system requires signed assertions from the SAML IdP, ensure that the
    Want Signed Assertion
     check box remains selected.
  11. If this BIG-IP system requires encrypted assertions from the SAML IdP, select
    Want Encrypted Assertion
    . Then select a key and a certificate from those in the BIG-IP system store from the
    Assertion Decryption Private Key
     and
    Assertion Decryption Certificate
     lists.
    The BIG-IP system uses the private key and certificate to decrypt the assertion.
  12. To configure additional service provider attributes, from the left pane click
    Advanced
    .
    The screen displays the applicable settings.
  13. To force users to authenticate again even when they have an SSO session at the identity provider, select the
    Force Authentication
     check box.
    This setting is for use when the external IdP supports a force authentication flag.
  14. To allow the external IdP, when processing requests from this BIG-IP system as SP, to create a new identifier to represent the principal, select the
    Allow Name-Identifier Creation
     check box.
  15. To specify the type of identifier information to use, select a URI reference from the
    Name-Identifier Policy Format
     list.
    For example, if a Service Provider (SP) initiates SSO by sending an
    AuthnRequest
     to the IdP with format
    urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
    , then the IdP response should contain the subject identity in email format.
  16. To specify that the assertion subject's identifier be returned in the namespace of an SP other than the requester, or in the namespace of a SAML affiliation group of SPs, type a value in the
    SP Name-Identifier Qualifier
     field.
  17. Click
    OK
    .
    The screen closes.
APM creates the SAML SP service. It is available to bind to SAML IdP connectors and to export to a metadata file.

Binding the BIG-IP system (as IdP) with the SP service on this device

Bind the SAML SP service for this device (BIG-IP system) to the SAML IdP connector for the external BIG-IP system that acts as the IdP, so that this device requests authentication service from the IdP.
  1. On the Main tab, click
    Access
    Federation
    SAML Service Provider
    .
    The Local SP Services screen displays.
  2. Select a SAML SP service from the list.
  3. Click
    Bind/Unbind IdP Connectors
    .
    A pop-up screen displays a list of any IdP connectors that are associated with this SP service.
  4. Click
    Add New Row
    .
  5. Select the SAML IdP connector for the BIG-IP system that acts as the IdP in the federation.
    Because you are binding only one IdP connector to the SP service, you do not need to fill in the
    Matching Source
     and
    Matching Value
     fields.
  6. Click
    Update
    .
    The configuration is not saved until you click
    OK
    .
  7. Click
    OK
    .
    APM saves the configuration. The screen closes.
The SAML IdP connector that you selected is bound to the SAML SP service.

Exporting SAML SP metadata from APM

You need to convey the SP metadata from APM to the external SAML IdP that provides authentication service to this SP. Exporting the SAML SP metadata to a file provides you with the information that you need to do this.
  1. On the Main tab, click
    Access
    Federation
    SAML Service Provider
    .
    The Local SP Services screen displays.
  2. Select an SP service from the list and click
    Export Metadata
    .
    A popup window opens, displaying
    No
     on the
    Sign Metadata
     list.
  3. For APM to sign the metadata, perform these steps:
    1. From the
      Sign Metadata
       list, select
      Yes
      .
    2. From the
      Signing Key
       list, select a key.
      APM uses the key to sign the metadata.
    3. From the
      Signature Verification Certificate
       list, select a certificate.
      APM exports the certificate to the metadata file. The system on which you import the metadata file can use the certificate to verify the metadata signature.
  4. Select
    OK
    .
    APM downloads an XML file.
You must either import the XML file on the IdP system or use the information in the XML file to configure SP metadata on the IdP system .

Configuring an access policy to authenticate with an external SAML IdP

Before you start this task, configure an access profile.
When you use this BIG-IP system as a SAML service provider (SP), configure an access policy to direct users to an external SAML Identity Provider (IdP) for authentication.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. In the Per-Session Policy column, click the
    Edit
     link for the access profile you want to configure.
    The visual policy editor opens the access policy in a separate screen.
  3. Click the
    (+)
     icon anywhere in the access policy to add a new item.
    Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
    A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  4. On the Authentication tab, select
    SAML Auth
     and click the
    Add Item
     button.
    The SAML Auth properties window opens.
  5. In the SAML Authentication SP area from the
    AAA Server
    list, select a SAML SP service and click
    Save
    .
    The Access Policy window displays.
  6. Add any additional actions that you require to complete the policy.
  7. Change the Successful rule branch from
    Deny
     to
    Allow
    , and then click the
    Save
     button.
  8. At the top of the window, click the
    Apply Access Policy
     link to apply and activate your changes to this access policy.
  9. Click the
    Close
     button to close the visual policy editor.
You have an access policy that uses SAML authentication against an external SAML IdP and further qualifies the resources that a user can access.
Simple access policy to authenticate users against an external SAML IdP
Example access policy for SAML IdP-initiated connection
To apply this access policy to network traffic, add the access profile to a virtual server.
To ensure that logging is configured to meet your requirements, verify the log settings for the access profile.

Verifying log settings for the access profile

Confirm that the correct log settings are selected for the access profile to ensure that events are logged as you intend.
Log settings are configured in the
Access
Overview
Event Log
Settings
 area of the product. They enable and disable logging for access system and URL request filtering events. Log settings also specify log publishers that send log messages to specified destinations.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. Click the name of the access profile that you want to edit.
    The properties screen opens.
  3. On the menu bar, click
    Logs
    .
    The access profile log settings display.
  4. Move log settings between the
    Available
     and
    Selected
     lists.
    You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.
    Logging is disabled when the
    Selected
     list is empty.
  5. Click
    Update
    .
An access profile is in effect when it is assigned to a virtual server.

Adding the access profile to the virtual server

You associate the access profile with the virtual server so that the system can apply the profile to incoming traffic.
  1. On the Main tab, click
    Local Traffic
    Virtual Servers
    .
    The Virtual Server List screen opens.
  2. Click the name of the virtual server you want to modify.
  3. In the Access Policy area, from the
    Access Profile
     list, select the access profile that you configured earlier.
  4. Click
    Update
     to save the changes.

Setting up connectivity from the IdP system to the SP systems

You log in to the BIG-IP system that you configured as the SAML Identity Provider (IdP) so that you can set up connectivity to the BIG-IP systems you configured as SAML service providers (SPs).
  1. Log on to the BIG-IP system that you have selected to act as the SAML IdP in a SAML federation of BIG-IP systems.

Configuring SAML SP connectors from SAML SP metadata files

Import SP metadata into this BIG-IP system from each BIG-IP system that is configured as an SP to create SP connectors in this system that you can use to create a federation of BIG-IP systems.
  1. On the Main tab, click
    Access
    Federation
    SAML Identity Provider
    External SP Connectors
    .
    A list of SAML SP connectors displays.
  2. Select
    Create
    From Metadata
    The Create New SAML Service Provider window opens.
  3. In the
    Select File
     field, browse to and select the metadata file for the service provider.
  4. In the
    Service Provider Name
     field, type a unique name for the service provider.
  5. If the metadata is signed, select the certificate from the
    Select Signing Certificate
     list.
  6. Click
    OK
    .
    The file is uploaded, the SAML SP connector is created, and the window closes.
The SAML SP connector is displayed on the External SP Connectors list.

Binding a SAML IdP service to one SP connector

Bind a SAML Identity Provider (IdP) service and a SAML service provider (SP) connector so that the BIG-IP system can provide authentication (SAML IdP service) to the external SAML service provider.
  1. On the Main tab, click
    Access
    Federation
    SAML Identity Provider
    .
    The Local IdP Services screen opens.
  2. Select a SAML IdP service from the list.
    Select an IdP service that you configured for use with one particular SP connector only.
  3. Click
    Bind/Unbind SP Connectors
    .
    The screen displays a list of available SAML SP connectors.
  4. Select the one SAML SP connector that you want to pair with this IdP service.
  5. Select
    OK
    .
    The screen closes.
The SAML SP connector that you selected is bound to the SAML IdP service.

Configuring a full webtop

A full webtop allows your users to connect and disconnect from a network access connection, portal access resources, SAML resources, app tunnels, remote desktops, and administrator-defined links.
  1. On the Main tab, click
    Access
    Webtops
    Webtop Lists
    .
    The Webtops screen displays.
  2. Click
    Create
    .
    The New Webtop screen opens.
  3. In the
    Name
     field, type a name for the webtop.
  4. From the
    Type
     list, select
    Full
    .
    The Configuration area displays with additional settings configured at default values.
  5. Click
    Finished
    .
The webtop is now configured, and appears in the list. You can edit the webtop further, or assign it to an access policy.
To use this webtop, it must be assigned to an access policy with an advanced resource assign action or with a webtop, links, and sections assign action. All resources assigned to the full webtop are displayed on the full webtop.

Configuring an access policy for a SAML SSO portal

Before you configure this access policy, configure an access profile without selecting an SSO configuration for it.
Configure an access policy so that the BIG-IP system, as a SAML Identity Provider (IdP) can authenticate users using any non-SAML authentication type, and assign SAML resources and a webtop to the session.
This access policy supports users that initiate a connection at a SAML service provider or at the SAML IdP.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. In the Per-Session Policy column, click the
    Edit
     link for the access profile you want to configure.
    The visual policy editor opens the access policy in a separate screen.
  3. Click the
    (+)
     icon anywhere in the access policy to add a new item.
    Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
    A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  4. On the Logon tab, select
    Logon Page
     and click the
    Add Item
     button.
    The Logon Page Agent properties screen opens.
  5. Make any changes that you require to the logon page properties and click
    Save
    .
    The properties screen closes and the policy displays.
  6. Add one or more authentication checks on the fallback branch after the
    Logon Page
     action.
    Select the authentication checks that are appropriate for application access at your site.
  7. On a successful branch after an authentication check, assign SAML resources and a full webtop to the session.
    1. Click plus
      [+]
       on a successful branch after an authentication check.
      The Add Item window opens.
    2. On the Assignment tab, select the
      Advanced Resource Assign
       agent, and then click
      Add Item
      .
      The Resource Assignment window opens.
    3. Click
      Add new entry
      .
      An
      Empty
       entry displays.
    4. Click the
      Add/Delete
       link below the entry.
      The screen changes to display resources on multiple tabs.
    5. Select the SAML tab, then from it select the SAML resources that represent the service providers that authorized users can access.
    6. Click
      Update
      .
      The window changes to display the Properties screen, where the selected SAML resources are displayed.
    7. Click the
      Add/Delete
       link below the entry.
      The screen changes to display resources on multiple tabs.
    8. Select the Webtop tab, then select a full webtop on which to present the selected resources.
      You must assign a full webtop to the session even if you have configured all SAML resources to not publish on a webtop.
    9. Click
      Update
      .
      The window changes to display the Properties screen. The selected webtop and SAML resources are displayed.
    10. Click
      Save
      .
      The Properties window closes and the Access Policy window is displayed.
    You have configured a webtop to display resources that are available from service providers and that an authorized user can access.
  8. Add any other branches and actions that you need to complete the policy.
  9. Change the Successful rule branch from
    Deny
     to
    Allow
    , and then click the
    Save
     button.
  10. Click the
    Apply Access Policy
     link to apply and activate the changes to the policy.
  11. Click the
    Close
     button to close the visual policy editor.
You have an access policy that presents a logon page, authenticates the user, and assigns SAML resources and a full webtop on which to present them to the user.
Simple access policy for access to services on SAML service providers
Example access policy for SAML IdP-initiated connection
To apply this access policy to network traffic, add the access profile to a virtual server.
To ensure that logging is configured to meet your requirements, verify the log settings for the access profile.

Verifying log settings for the access profile

Confirm that the correct log settings are selected for the access profile to ensure that events are logged as you intend.
Log settings are configured in the
Access
Overview
Event Log
Settings
 area of the product. They enable and disable logging for access system and URL request filtering events. Log settings also specify log publishers that send log messages to specified destinations.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. Click the name of the access profile that you want to edit.
    The properties screen opens.
  3. On the menu bar, click
    Logs
    .
    The access profile log settings display.
  4. Move log settings between the
    Available
     and
    Selected
     lists.
    You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.
    Logging is disabled when the
    Selected
     list is empty.
  5. Click
    Update
    .
An access profile is in effect when it is assigned to a virtual server.

Adding the access profile to the virtual server

You associate the access profile with the virtual server so that the system can apply the profile to incoming traffic.
  1. On the Main tab, click
    Local Traffic
    Virtual Servers
    .
    The Virtual Server List screen opens.
  2. Click the name of the virtual server you want to modify.
  3. In the Access Policy area, from the
    Access Profile
     list, select the access profile that you configured earlier.
  4. Click
    Update
     to save the changes.
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information