Forum Discussion

Abdessamad_851's avatar
Abdessamad_851
Icon for Nimbostratus rankNimbostratus
Oct 10, 2017

Update SAML attributes

Hello,

 

I would like to know if it's possible to update a SAML attribute on an existing session when the F5 is used as IdP.

 

Here is the scenario:

 

1 - User ask to login in SP-A.

 

2 - He gets redirected to the IdP (F5), login, gets a saml assertion and get back to SP-A.

 

3 - User go to another SP-B and ask to connect.

 

4 - He gets redirected to the IdP, as he already have a session, the F5 redirects him back to SP-B with the saml assertion.

 

One of the saml attribute is drived from a session variable, and this variable will change when the user goes to SP-B. The problem is that the attribute value is not updated in step 4.

 

Any idea how to solve this issue?

 

Thanks.

 

APM
application delivery
saml
security

5 Replies

Sort By
  • Abdessamad1's avatar
    Abdessamad1
    Icon for Cirrostratus rankCirrostratus
    Oct 10, 2017

    I did look at the per-request policy, but there is no option to update the saml assertion.

     

    The value I want to refresh is a custom token with a lifetime that we added as a saml attribute. So when the user access the second SP, I want to provide him with a new token value in the saml attribute, not the one that was provided with the first SP.

     

  • Daniel_Varela's avatar
    Daniel_Varela
    Icon for Employee rankEmployee
    Oct 10, 2017

    My idea is to modify a session variable during the per request policy evauation using and irule through an irule agent. In your SAML configuration then map that session variable to your SAML attribute.

     

  • Abdessamad1's avatar
    Abdessamad1
    Icon for Cirrostratus rankCirrostratus
    Oct 10, 2017

    I can already update the session variable via an iRule, that's no the problem.

    The thing is that the saml attribute is somehow fixed the first time it is set (even if it's configured to use the session variable).

    Here is an extract of my irule:

    when HTTP_REQUEST {
    if { [HTTP::uri] starts_with "/saml/idp/profile/redirectorpost/sso" }{
        if { [HTTP::cookie exists MRHSession] and [ACCESS::session exists -state_allow [HTTP::cookie value MRHSession]] } {
            set oauthResp [call oauthCall]
            ACCESS::session data set session.oauth.access_token [call key2value $oauthResp access_token]
        }
    }
}

    But the F5 is using the same attribute values it got the first time, the variable update is no taken into account