When a BIG-IP system is configured as a SAML service provider (SP), you can use SAML identity provider (IdP) automation to automatically create new SAML IdP connectors for SP services. Access Policy Manager (APM) polls a file or files that you supply; the files must contain cumulative IdP metadata. After polling, APM creates IdP connectors for any new IdPs and associates them with a specified SP service. APM uses matching criteria that you supply to send the user to the correct IdP.

1. On the Main tab, click Access Policy > SAML > BIG-IP IdP Automation. The BIG-IP IdP Automation screen opens and displays a table. Each row includes a configuration name, the URLs where IdP metadata files are stored for a particular SP service, and the name of the SP service to which automation applies.
2. Click Create. The Create New SAML IdP Automation popup screen opens.
3. In the Name field, type a name for the IdP automation configuration.
4. For the SP Service setting, select a service from the list. If the SP service you want has not already been defined, click Create to configure it and add it to the list. APM periodically creates SAML IdP connectors and binds them to the SP service you specify here.
5. From the IdP Matching Source list, select or type the name of a session variable. At the time of SP-initiated SAML single sign-on, APM (as a SAML SP) matches the value of this session variable to the value in the tag that you specify in the Metadata Tag Match Value field.
6. In the Metadata Tag Match Value field, type the name of a metadata tag. APM extracts the value in this tag from the IdP metadata and matches it with the value of the session variable specified in the IdP Matching Source field.
   Note: Do not include any wildcard in the value.
7. In the Metadata Tag For IdP Connector Name field, type the name of a tag that is included in the IdP metadata. APM uses the value in the tag to name the IdP connector that it creates.
8. In the Frequency field, type a number of minutes. This specifies how often APM polls IdP metadata files.
9. Select Metadata URLs from the left pane. You specify URLs for one or more cumulative metadata files located on remote systems. A URL table displays in the right pane.
10. Specify a URL for each SAML IdP metadata file to be read. To add each URL, follow these steps:
    1. Click Add. A new field opens in the URL table.
    2. Type a URL. Begin the URL with http or https. For example, type https://mywebsite.com/metdata/idp/idp_metadata.xml.
    3. Click Update. The new URL displays in the top row of the table.
11. Click OK. The Create SAML IdP Automation screen closes. The new automation displays in the list.