A SAML IdP service is a type of single sign-on (SSO) authentication service in Access Policy Manager (APM). When you use a BIG-IP system as a SAML identity provider (IdP), a SAML IdP service provides SSO authentication for external SAML service providers (SPs). You must bind a SAML IdP service to SAML SP connectors, each of which specifies an external SP. APM responds to authentication requests from the service providers and produces assertions for them.

A SAML service provider connector (an SP connector) specifies how a BIG-IP system, configured as a SAML Identity Provider (IdP), connects with an external service provider.

You can use one or more of these methods to configure SAML service provider (SP) connectors in Access Policy Manager.

• From metadata - Obtain a metadata file from the vendor and import it into Access Policy Manager. The advantage to this method is that the vendor provides the majority of all required data, including certificates. You can complete the configuration by simply typing a unique name for the SP connector, a very few additional required fields, and browsing to and importing the file. Access Policy Manager then configures the SP connector.
• From template - Use templates that Access Policy Manager provides for some vendors; for example, Google. The advantages to this method are that:
  • Most required data is included in the template
  • Additional required data is minimal. You can obtain it and certificates from the vendor
  After you select a template and type data into a few fields, Access Policy Manager configures the SP connector.
• Custom - Obtain information from the vendor and type the settings into the Configuration utility. To use this method, you must also obtain certificates from the vendor and import them into the BIG-IP system. Use this method when a metadata file or a template for an SP connector is not available.

This flowchart illustrates the process for configuring a BIG-IP system as a SAML identity provider (IdP) that provides an SSO portal.

1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
2. Click the Create button. The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type the IP address for a host virtual server. This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
5. In the Service Port field, type 443 or select HTTPS from the list.
6. For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
7. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL profile you previously created, and using the Move button, move the name to the Selected list.
8. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL profile you previously created, and using the Move button, move the name to the Selected list.
9. Click Finished.

1. On the Main tab, click Access Policy > SAML > BIG-IP as IdP. The BIG-IP as IdP screen displays a list of SAML IdP services.
2. On the menu bar, click External SP Connectors. A list of SAML SP connectors displays.
3. Click Create. The Create New SP Connector screen opens.
4. In the Service Provider Name field, type a unique name for the SAML SP connector.
5. In the SP Entity ID field, type a unique identifier for the service provider. This is usually a unique URI that represents the service provider. You should obtain this value from the service provider.
6. Select Endpoint Settings from the left pane. The appropriate settings are displayed.
   1. In the Assertion Consumer Service URL field, type the URL where the IdP can send an assertion to this service provider. APM supports HTTP-POST binding and HTTP-Artifact binding to this service.
   2. In the Binding setting, select Artifact or POST.
   3. Optional: In the Relay State field, type a value. The relay state can be an absolute path, such as /hr/index.html; it can be a URL, such as https://www.abc.com/index.html; or, it can be anything that the service provider understands. The service provider uses this information to redirect users after they are authenticated. APM sends this value back to the service provider as part of the assertion response in the RelayState parameter.

      When the RelayState parameter is already part of the authentication request to the BIG-IP system, APM returns the value that was sent in the request. Otherwise, APM uses the value from this configuration.

7. Select Security Settings from the left pane.
   1. Optional: At the top of the screen, select either Sign Authentication Request sent to this device by SP or Sign Artifact Resolution Request sent to this device by SP. The setting indicates whether this service provider signs the authentication requests or the artifact resolution requests it sends to the SAML IdP (this BIG-IP system).
   2. In the Assertion sent to SP by this device area, select Must be signed (default setting). When this setting is selected, APM signs the assertion that it sends to this service provider. Clearing this setting is not recommended.
   3. If this service provider requires an encrypted assertion from the IdP (this BIG-IP system), select Must be encrypted and select an Encryption Type. APM supports AES128, AES192, and AES256 encryption types.
   4. In the Certificate Settings area, select a certificate from the SP's Certificate list. This device (BIG-IP system as IdP) uses the certificate to verify the signature of the authentication request from the SP. It also uses it to encrypt the assertion sent to the SP from this device.
8. Select SLO Service Settings from the left pane. SLO stands for Single Logout.
   1. Optional: In the Single Logout Request URL field, type a URL where APM should send a logout request to this service provider when the BIG-IP system initiates a logout request.
   2. In the Single Logout Response URL field, type a URL to which the SP should send a logout response to the BIG-IP system to indicate that single logout is complete.
   Note: APM supports HTTP-POST binding for the SLO service. For SLO to work, all entities (SPs and IdPs), must support SLO.

1. On the Main tab, click Access Policy > Webtops.
2. Click Create to create a new webtop.
3. Type a name for the webtop you are creating.
4. From the Type list, select Full.
5. Click Finished.

1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
2. In the Access Policy column, click the Edit link for the access profile you want to configure. The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new action item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Logon tab, select Logon Page and click the Add Item button. The Logon Page Agent properties screen opens.
5. Make any changes that you require to the logon page properties and click Save. The properties screen closes and the visual policy editor displays.
6. Add one or more authentication checks on the fallback branch after the Logon Page action. Select the authentication checks that are appropriate for application access at your site.
7. On a successful branch after an authentication check, assign SAML resources and a full webtop to the session.
   1. Click plus [+] on a successful branch after an authentication check. The Add Item window opens.
   2. On the Assignment tab, select the Advanced Resource Assign agent, and click Add Item. The Resource Assignment window opens.
   3. Click Add new entry. An Empty entry displays.
   4. Click the Add/Delete link below the entry. The screen changes to display resources on multiple tabs.
   5. Select the SAML tab, then from it select the SAML resources that represent the service providers that authorized users can access.
   6. Click Update. The window changes to display the Properties screen, where the selected SAML resources are displayed.
   7. Click the Add/Delete link below the entry. The screen changes to display resources on multiple tabs.
   8. Select the Webtop tab, then select a full webtop on which to present the selected resources. You must assign a full webtop to the session even if you have configured all SAML resources to not publish on a webtop.
   9. Click Update. The window changes to display the Properties screen. The selected webtop and SAML resources are displayed.
   10. Click Save. The Properties window closes and the Access Policy window is displayed.
   You have configured a webtop to display resources that are available from service providers and that an authorized user can access.
8. Optional: Add any other branches and actions that you need to complete the access policy.
9. Change the Successful rule branch from Deny to Allow and click the Save button.
10. Click the Apply Access Policy link to apply and activate the changes to the access policy.
11. Click the Close button to close the visual policy editor.

Simple access policy for access to services on SAML service providers

1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
4. Click Update to save the changes.