Forum Discussion

shashank_shetti's avatar
shashank_shetti
Icon for Nimbostratus rankNimbostratus
Mar 24, 2016

SSO (SAML2.0) - APM Setup

We have an existing website for our customer login https://MyCompany.com/UserAccount/Login and once they login we land on a account summary page where they have links to our vendor site "https://vendorsite.com". On clicking the link they should be redirected to the vendor site with encrypted Saml2.0 token where they do not need to login again (SSO).

 

"MyCompany.com" has F5 in front. Website is based on angularjs and microsoft MVC. Authentication is not active directory, It goes against our sql database. (Basically a soap based call from website)

 

How would we integrate SSO to this existing site so when clicked on vendor link it passes saml assertion along with it.

 

Also I was assuming that I should start with creating Access Profile -> AAA Servers for http authentication (Form Based).

 

Can I give Form Action: "https://MyCompany.com/UserAccount/Login" (with http post)

 

Existing webiste authentication -> Http get to this url ""https://MyCompany.com/UserAccount/Login" will display the login page and when entered username and password we post to ""https://MyCompany.com/UserAccount/Login" which creates a secure cookie "secureCookie"

 

Not sure how the user name and password with form parameters/values will be integrated to this Access Policy.

 

I am doing this work with out training and I could not find any articles with examples. If you can provide an example, Will greatly appreciated.

 

APM
application delivery
security

1 Reply

Sort By
  • Cody_Green's avatar
    Cody_Green
    Icon for Employee rankEmployee
    Apr 06, 2016

    SQL database is not a supported APM AAA object so APM would have no native way to verify the user's identity. That being said, I have customers that write a simple HTTP Basic authentication app that can front-end the SQL DB and allow APM to use HTTP based authentication.

     

    IF you go down that route the user would 1st authenticate to APM and then F5 would SSO to your portal. When the user clicks on a link in your portal that link can be one of two things: 1) Link to an SP initiated SAML login 2) Link to an IdP initiated SAML login

     

    This really depends upon what features your external applications support.

     

    My recommendation would be to contact your local F5 sales team and have an architecture discussion with them so they can help you with the design.