Shib and F5 VPN authorization

[Youssef GHORBAL]

On 28 Nov 2017, at 22:03, Steven Carmody <steven_carmody at brown.edu<mailto:steven_carmody at brown.edu>> wrote:

Hi,

I'm passing along a question from the local team that manages our F5 VPN service. We've been using Shib to access the VPN for a while.

Does it mean that the F5 BigIP is the SP in this case ?

However, they're looking for help and suggestions for retrieving the attributes from the SAML Assertion and using them -- here's what they say:

Shib does provide the attribute but F5 cannot read it to authorize the user. We could create complicated custom irule to read the attributes from Shib. It is easier and cleaner to use the LDAP authorization existing module on F5. Please let me know if you know people from other schools who have created irules to read the attributes from Shib for authorization.

Has any campus created the irules they're referring to, and would be willing to share a model ?

We are using the F5 BigIP as SP to protect some ressources. In that case the APM module (handling SAML) exposes the attributes sent by the IdP in session variables and you can use them in the APM workflow for authorization.
Here is an extract from a session view. all the attr.xxxx are attributes sent by the IdP.

https://www.dropbox.com/s/4qqzowpfk1r4d0y/Screen%20Shot%202017-11-29%20at%2010.51.26.png?dl=0

You can use those attributes in iRules or in the APM policy editor (your F5 people will know)
Here is an exemple of un iRule that uses the session attribute uid to set the REMOTE_USER header.

https://www.dropbox.com/s/i31auythkp0g3gc/Screen%20Shot%202017-11-29%20at%2010.55.28.png?dl=0

If the F5 is not the SP, you'll have hard time parsing the XML content of SAML transactions and making sens of it just by regexp and TCL.

Hope this help.

Youssef Ghorbal
Institut Pasteur


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171129/7ea8a656/attachment.html>