Jeff.Krug: /* Unsolicited SSO (aka IDP Initiated SSO) */

2019-01-17T20:21:05Z

Unsolicited SSO (aka IDP Initiated SSO)

← Older revision		Revision as of 20:21, 17 January 2019
Line 17:		Line 17:

	=== Unsolicited SSO (aka IDP Initiated SSO) ===		=== Unsolicited SSO (aka IDP Initiated SSO) ===
	F5 ~~either~~ does not support unsolicited SSO (as it requires a cookie specifying which IDP handler to process a given assertion with prior to processing it).		F5 does not support unsolicited SSO (as it requires a cookie specifying which IDP handler to process a given assertion with prior to processing it).

	=== SAML Redirect Binding ===		=== SAML Redirect Binding ===

Jeff.Krug at 20:08, 17 January 2019

2019-01-17T20:08:52Z

← Older revision		Revision as of 20:08, 17 January 2019
Line 3:		Line 3:
	\|}		\|}

			== About ==
			This page enumerates some outstanding issues using F5 as a SAML Service Provider within NIEF.

			== Issues ==
			Be aware that some of these issues may eventually be fixed and the list will try to be updated as these fixes occur.

			=== Canoncialization ===
			It looks like there might be canonicalization issues when an attribute value includes unicode (or perhaps any non-standard character). It's entirely possible that this is not a F5 bug, but a Shibboleth and/or SAML in general issue. Regardless, it was identified that Shib -> F5 communication failed when an attribute value included a non-standard character.

			=== SAML Metadata / Importing New Entities ===
			* If the SAML entity supports multiple certificates, F5 is likely to only work with one of these certificates (and it's not likely to be clear which certificate it is using). Likely the metadata should be reduced to specify only a single certificate prior to importing.
			* F5 may not parse out the SSO bindings correctly when determining what URL to use for SAML SSO (specifically, it will try and use the Shibboleth endpoint for a default Shibboleth IDP metadata file instead of the SAML endpoint). At a minimum review the endpoint URL for correctness when importing.

			=== Unsolicited SSO (aka IDP Initiated SSO) ===
			F5 either does not support unsolicited SSO (as it requires a cookie specifying which IDP handler to process a given assertion with prior to processing it).

			=== SAML Redirect Binding ===
			F5 currently does not support the SAML Redirect Binding. There is an outstanding bug that they are working on, so a hot fix may be available soon.

			=== Assertion Size Limitations ===
			F5 can panic on really large assertions (generated when many, many attributes and/or attribute values) are transmitted in an SAML SSO Assertion. When it fails like this it fails to respond to the HTTP message entirely leaving most browsers to appear to have failed at the IDP.

Jeff.Krug: Created page with "{| !class="gfipmnav"|Main Page |} {| !class="gfipmnav"|Main Page |}"

2019-01-17T20:07:59Z

Created page with "{| !class="gfipmnav"|Main Page |} {| !class="gfipmnav"|Main Page |}"

New page

{|
!class="gfipmnav"|[[NIEF Implementers Wiki|Main Page]]
|}

{|
!class="gfipmnav"|[[NIEF Implementers Wiki|Main Page]]
|}

F5 Implementation - Revision history

Jeff.Krug: /* Unsolicited SSO (aka IDP Initiated SSO) */

Jeff.Krug at 20:08, 17 January 2019

Jeff.Krug: Created page with "{| !class="gfipmnav"|Main Page |} {| !class="gfipmnav"|Main Page |}"