A SAML service provider connector (an SP connector) specifies how a BIG-IP^® system, configured as a SAML Identity Provider (IdP), connects with an external service provider.

You can use one or more of these methods to configure SAML service provider (SP) connectors in Access Policy Manager^®.

• From metadata - Obtain a metadata file from the vendor and import it into Access Policy Manager. The advantage to this method is that the vendor provides the majority of all required data, including certificates. You can complete the configuration by simply typing a unique name for the SP connector, a very few additional required fields, and browsing to and importing the file. Access Policy Manager then configures the SP connector.
• From template - Use templates that Access Policy Manager provides for some vendors; for example, Google. The advantages to this method are that:
  • Most required data is included in the template
  • Additional required data is minimal. You can obtain it and certificates from the vendor
  After you select a template and type data into a few fields, Access Policy Manager configures the SP connector.
• Custom - Obtain information from the vendor and type the settings into the Configuration utility. To use this method, you must also obtain certificates from the vendor and import them into the BIG-IP^® system. Use this method when a metadata file or a template for an SP connector is not available.

An IdP connector specifies how a BIG-IP^® system, configured as a SAML service provider (SP), connects with an external SAML identity provider (IdP).

You can use one or more of these methods to configure SAML identity provider (IdP) connectors in Access Policy Manager^® (APM^®).

• From metadata - Obtain a metadata file from the vendor and import it into APM. The advantage to this method is that the vendor provides all required data, including the certificate. You can complete the configuration by simply typing a unique name for the identity provider, and browsing to and importing the file. APM imports the certificate to the BIG-IP^® system and configures the SAML IdP connector.
• From template - Use templates that APM provides for some vendors. The advantages to this method are that:
  • Most required data is included in the template. (Note that the certificate is not included.)
  • Additional required data is minimal and is available from the vendor.
  APM configures the SAML IdP connector. You must obtain a certificate from the vendor and import it into the BIG-IP system.
• Custom - Research the identity provider requirements and type all settings into the Configuration utility. Use this method when a metadata file or a template for an identity provider is not available. APM configures the SAML IdP connector. You must obtain a certificate from the vendor and import it into the BIG-IP system.
• IdP Automation - Provide files with cumulative IdP metadata on remote systems, then configure BIG-IP IdP automation to poll the files periodically and create IdP connectors and bind them to a specific service provider (SP) service.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type the IP address for a host virtual server.
   This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
5. In the Service Port field, type 443 or select HTTPS from the list.
6. For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
7. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL profile you previously created and move the name to the Selected list.
8. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL profile you previously created and move the name to the Selected list.
9. Click Finished.

1. On the Main tab, click Access > Federation > SAML Identity Provider > Artifact Resolution Services .
2. Click Create.
   The Create New SAML Artifact Resolution Service popup screen opens, showing general settings.
3. In the Name field, type a name for the artifact resolution service.
4. In the Description field, type a new description.
5. Click Service Settings.
6. From the Virtual Server list, select the virtual server that you created previously.
   ARS listens on the IP address and port configured on the virtual server.
7. In the Artifact Validity (Seconds) field, type the number of seconds for which the artifact remains valid. The default is 60 seconds.
   The BIG-IP^® system deletes the artifact if the number of seconds exceeds the artifact validity number.
8. For the Send Method setting, select the binding to use to send the artifact, either POST or Redirect.
9. In the Host field, type the host name defined for the virtual server, for example ars.siterequest.com.
10. In the Port field, type the port number defined in the virtual server. The default is 443.
11. Click Security Settings.
12. To require that artifact resolution messages from an SP be signed, select the Sign Artifact Resolution Request check box.
13. To use HTTP Basic authentication for artifact resolution request messages, in the User Name field, type a name for the artifact resolution service request and in the Password field, type a password.
    These credentials must be present in all Artifact Resolve Requests sent to this ARS.
14. Click OK.
    The popup screen closes, leaving the Artifact Resolution Services list screen open.

1. On the Main tab, click Access > Federation > SAML Identity Provider .
   The Local IdP Services screen opens.
2. Click Create.
   The Create New IdP Service popup screen displays.
3. In the IdP Service Name field, type a unique name for the SAML IdP service.
4. In the IdP Entity ID field, type a unique identifier for the IdP (this BIG-IP^® system).
   Typically, the ID is a URI that points to the BIG-IP virtual server that is going to act as a SAML IdP. If the entity ID is not a valid URL, the Host field is required.
   For example, type https://siterequest.com/idp, where the path points to the virtual server you use for BIG-IP system as a SAML IdP.
5. If the IdP Entity ID field does not contain a valid URI, you must provide one in the IdP Name Settings area:
   1. From the Scheme list select https or http.
   2. In the Host field, type a host name.
      For example, type siterequest.com in the Host field.
6. If you select SAML Profiles on the left pane, the Web Browser SSO check box is selected by default.
   At least one profile must be selected.
7. To specify that this IdP use an artifact resolution service, click Endpoint Settings on the left pane and select a service from the Artifact Resolution Service list.
8. On the left pane, select Assertion Settings and complete the settings that display:
   1. From the Assertion Subject Type list, select the type of subject for the IdP to authenticate.
   2. From the Assertion Subject Value list, select the name of a session variable.
      This variable, %{session.logon.last.username}, is generally applicable. Some session variables are applicable depending on the type of authentication that you use for your site.
   3. In the Authentication Context Class Reference field, select a URI reference.
      The URI reference identifies an authentication context class that describes an authentication context declaration.
   4. In the Assertion Validity (in seconds) field, type the number of seconds for which the assertion is valid.
   5. To encrypt the subject, select the Enable encryption of Subject check box.
      The Encryption Strength list becomes available.
   6. From the Encryption Strength list, select a value.
      Supported values are AES128, AES192, and AES256.
9. On the left pane, select SAML Attributes, and for each attribute that you want to include in the attribute statement, repeat these substeps.
   1. Click Add.
      A Create New SAML Attribute popup screen displays.
   2. In the Name field, type a unique name for the attribute.
      Usually, the name is a fixed string, but it can be a session variable.
   3. To add a value to the attribute, click Add, type a value in the Value(s) field, and click Update to complete the addition.
      You can use a session variable for the value.
      This example shows using a fixed string for the name and a session variable for the value. Name: user_telephonenumber and value: %{session.ad.last.attr.telephoneNumber}.
      You can repeat this step to add multiple values for an attribute.
   4. To encrypt the values, select the Encrypt check box and select a value from the Type list.
      Supported values for type are AES128, AES192, and AES256.
   5. Click OK.
      The Create New SAML Attribute popup screen closes.
10. Click Security Settings from the left pane.
    1. From the Signing Key list, select the key from the BIG-IP system store.
       None is selected by default.
    2. From the Signing Certificate list, select the certificate from the BIG-IP system store.
       When selected, the IdP (the BIG-IP system) publishes this certificate to the service provider so the service provider can verify the assertion. None is selected by default.
11. Click OK.
    The popup screen closes. The new IdP service appears on the list.

1. On the menu bar, expand SAML Service Provider and click External IdP Connectors.
   The External IdP Connectors screen displays.
2. Select Create > From Metadata .
   The Create New SAML IdP Connector screen opens.
3. In the Select File field, browse to and select the metadata file for the IdP.
4. In the Identity Provider Name field, type a unique name for the IdP.
5. If the metadata is signed, select a certificate from the Select Signing Certificate list.
6. Click OK.
   The file is uploaded, the SAML IdP connector is created, and the screen closes.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type the IP address for a host virtual server.
   This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
5. In the Service Port field, type 443 or select HTTPS from the list.
6. For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
7. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL profile you previously created and move the name to the Selected list.
8. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL profile you previously created and move the name to the Selected list.
9. Click Finished.

1. On the Main tab, click Access > Federation > SAML Service Provider .
   The Local SP Services screen displays.
2. Click Create.
   The Create New SAML SP Service screen opens.
3. In the Name field, type a unique name for the SAML SP service.
4. In the Entity ID field, type a unique identifier for the service provider.
   Typically entity ID is a URI that points to the BIG-IP virtual server that is going to act as SAML SP. If the entity ID is not a valid URL, the Host field is required.
   For example, type https://bigip-sp, where https:/bigip-sp points to the virtual server you use for BIG-IP system as a SAML service provider.
5. If the Entity ID field does not contain a valid URI, in the SP Name Settings area from the Scheme list, select https or http and in the Host field, type a host name.
   For example, type siterequest.com in the Host field.
6. In the Relay State field, type a scheme, host, and path.
   This is a path is where this BIG-IP^® system redirects users after they are authenticated.
7. For this service provider to request an artifact instead of an assertion from the IdP, from the left pane select Endpoint Settings and, from the Assertion Consumer Service Binding list, select Artifact.
   POST is the default setting.
8. From the left pane, select Security Settings.
   The screen displays the applicable settings.
9. If you want this BIG-IP system to send signed authentication requests to the SAML IdP, select Signed Authentication Request. Then select a key and a certificate from those in the BIG-IP system store from the Message Signing Private Key and Message Signing Certificate lists.
10. If this BIG-IP system requires signed assertions from the SAML IdP, ensure that the Want Signed Assertion check box remains selected.
11. If this BIG-IP system requires encrypted assertions from the SAML IdP, select Want Encrypted Assertion. Then select a key and a certificate from those in the BIG-IP system store from the Assertion Decryption Private Key and Assertion Decryption Certificate lists.
    The BIG-IP system uses the private key and certificate to decrypt the assertion.
12. To configure additional service provider attributes, from the left pane click Advanced.
    The screen displays the applicable settings.
13. To force users to authenticate again even when they have an SSO session at the identity provider, select the Force Authentication check box.
    This setting is for use when the external IdP supports a force authentication flag.
14. To allow the external IdP, when processing requests from this BIG-IP system as SP, to create a new identifier to represent the principal, select the Allow Name-Identifier Creation check box.
15. To specify the type of identifier information to use, select a URI reference from the Name-Identifier Policy Format list.
    For example, if a Service Provider (SP) initiates SSO by sending an AuthnRequest to the IdP with format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress, then the IdP response should contain the subject identity in email format.
16. To specify that the assertion subject's identifier be returned in the namespace of an SP other than the requester, or in the namespace of a SAML affiliation group of SPs, type a value in the SP Name-Identifier Qualifier field.
17. Click OK.
    The screen closes.

1. On the Main tab, click Access > Federation > SAML Service Provider .
   The Local SP Services screen displays.
2. Select a SAML SP service from the list.
3. Click Bind/Unbind IdP Connectors.
   A pop-up screen displays a list of any IdP connectors that are associated with this SP service.
4. Click Add New Row.
5. Select the SAML IdP connector for the BIG-IP system that acts as the IdP in the federation.
   Because you are binding only one IdP connector to the SP service, you do not need to fill in the Matching Source and Matching Value fields.
6. Click Update.
   The configuration is not saved until you click OK.
7. Click OK.
   APM^® saves the configuration. The screen closes.

1. On the Main tab, click Access > Federation > SAML Service Provider .
   The Local SP Services screen displays.
2. Select an SP service from the list and click Export Metadata.
   A popup window opens, displaying No on the Sign Metadata list.
3. For APM to sign the metadata, perform these steps:
   1. From the Sign Metadata list, select Yes.
   2. From the Signing Key list, select a key.
      APM uses the key to sign the metadata.
   3. From the Signature Verification Certificate list, select a certificate.
      APM exports the certificate to the metadata file. The system on which you import the metadata file can use the certificate to verify the metadata signature.
4. Select OK.
   APM downloads an XML file.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Authentication tab, select SAML Auth and click the Add Item button.
   The SAML Auth properties window opens.
5. In the SAML Authentication SP area from the AAA Server list, select a SAML SP service and click Save.
   The Access Policy window displays.
6. Add any additional actions that you require to complete the policy.
7. Change the Successful rule branch from Deny to Allow, and click the Save button.
8. At the top of the window, click the Apply Access Policy link to apply and activate your changes to this access policy.
9. Click the Close button to close the visual policy editor.

Simple access policy to authenticate users against an external SAML IdP

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. On the menu bar, click Logs.
   The access profile log settings display.
4. Move log settings between the Available and Selected lists.
   You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.

   Note: Logging is disabled when the Selected list is empty.
5. Click Update.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
4. Click Update to save the changes.

1. On the Main tab, click Access > Federation > SAML Identity Provider > External SP Connectors .
   A list of SAML SP connectors displays.
2. Select Create > From Metadata
   The Create New SAML Service Provider window opens.
3. In the Select File field, browse to and select the metadata file for the service provider.
4. In the Service Provider Name field, type a unique name for the service provider.
5. If the metadata is signed, select the certificate from the Select Signing Certificate list.
6. Click OK.
   The file is uploaded, the SAML SP connector is created, and the window closes.

1. On the Main tab, click Access > Webtops > Webtop Lists .
   The Webtops screen displays.
2. Click Create.
   The New Webtop screen opens.
3. In the Name field, type a name for the webtop.
4. From the Type list, select Full.
   The Configuration area displays with additional settings configured at default values.
5. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Logon tab, select Logon Page and click the Add Item button.
   The Logon Page Agent properties screen opens.
5. Make any changes that you require to the logon page properties and click Save.
   The properties screen closes and the policy displays.
6. Add one or more authentication checks on the fallback branch after the Logon Page action.
   Select the authentication checks that are appropriate for application access at your site.
7. On a successful branch after an authentication check, assign SAML resources and a full webtop to the session.
   1. Click plus [+] on a successful branch after an authentication check.
      The Add Item window opens.
   2. On the Assignment tab, select the Advanced Resource Assign agent, and click Add Item.
      The Resource Assignment window opens.
   3. Click Add new entry.
      An Empty entry displays.
   4. Click the Add/Delete link below the entry.
      The screen changes to display resources on multiple tabs.
   5. Select the SAML tab, then from it select the SAML resources that represent the service providers that authorized users can access.
   6. Click Update.
      The window changes to display the Properties screen, where the selected SAML resources are displayed.
   7. Click the Add/Delete link below the entry.
      The screen changes to display resources on multiple tabs.
   8. Select the Webtop tab, then select a full webtop on which to present the selected resources.
      You must assign a full webtop to the session even if you have configured all SAML resources to not publish on a webtop.
   9. Click Update.
      The window changes to display the Properties screen. The selected webtop and SAML resources are displayed.
   10. Click Save.
       The Properties window closes and the Access Policy window is displayed.
   You have configured a webtop to display resources that are available from service providers and that an authorized user can access.
8. Optional: Add any other branches and actions that you need to complete the policy.
9. Change the Successful rule branch from Deny to Allow, and click the Save button.
10. Click the Apply Access Policy link to apply and activate the changes to the policy.
11. Click the Close button to close the visual policy editor.

Simple access policy for access to services on SAML service providers

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. On the menu bar, click Logs.
   The access profile log settings display.
4. Move log settings between the Available and Selected lists.
   You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.

   Note: Logging is disabled when the Selected list is empty.
5. Click Update.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
4. Click Update to save the changes.