From simlu at su.se  Wed Sep  2 12:47:33 2026
From: simlu at su.se (=?utf-8?B?U2ltb24gTHVuZHN0csO2bQ==?=)
Date: Wed, 2 Sep 2026 12:47:33 +0000
Subject: OIDC Authorization code affinity loadbalancing
Message-ID: <F3B5D1AE-CA95-44A4-81CA-837A2701561D@su.se>

Hey all,

While implementing OIDC for our IDP I wrote a, hopefully, complete iRule for the F5 BIG-IP loadbalancers to support the authorization_code grant according to the documentation[1].

I?ve added the iRule to the documentation. Let me know if you want it on a separate page or in some other way.

Scott (and/or Henri?): Can you verify the iRule so I covered all cases? I tried to read the code but I?m not that great at reading Java. Please let me know and I?ll fix it.

BR,
- Simon

____________________________________

Simon Lundstr?m
Section for Infrastructure

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

1, <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2936078374/AuthorizationCodeAffinity>

From scott at restingparrotsoftware.com  Wed Sep  2 16:02:49 2026
From: scott at restingparrotsoftware.com (Scott Cantor)
Date: Wed, 2 Sep 2026 12:02:49 -0400
Subject: OIDC Authorization code affinity loadbalancing
In-Reply-To: <F3B5D1AE-CA95-44A4-81CA-837A2701561D@su.se>
References: <F3B5D1AE-CA95-44A4-81CA-837A2701561D@su.se>
Message-ID: <42FD4761-D0F9-4E01-BE66-807777E0583F@restingparrotsoftware.com>



> On Sep 2, 2026, at 8:47?AM, Simon Lundstr?m via users <users at shibboleth.net> wrote:
> 
> While implementing OIDC for our IDP I wrote a, hopefully, complete iRule for the F5 BIG-IP loadbalancers to support the authorization_code grant according to the documentation[1].

I had lost hope it was viable to actually pull that off, but it's probably useful if one limits some of the options.

> I?ve added the iRule to the documentation. Let me know if you want it on a separate page or in some other way.

That seems the best place.

> Scott (and/or Henri?): Can you verify the iRule so I covered all cases? I tried to read the code but I?m not that great at reading Java. Please let me know and I?ll fix it.

I wouldn't have any idea, but I can't imagine it handles every possible case, plus the tokens themselves would have to be handled in general.

Since POST can be used, that alone seemed to be a dealbreaker...

Anything at all is very appreciated regardless.

Thanks,
-- Scott


From scott at restingparrotsoftware.com  Wed Sep  2 16:08:16 2026
From: scott at restingparrotsoftware.com (Scott Cantor)
Date: Wed, 2 Sep 2026 12:08:16 -0400
Subject: OIDC Authorization code affinity loadbalancing
In-Reply-To: <42FD4761-D0F9-4E01-BE66-807777E0583F@restingparrotsoftware.com>
References: <F3B5D1AE-CA95-44A4-81CA-837A2701561D@su.se>
 <42FD4761-D0F9-4E01-BE66-807777E0583F@restingparrotsoftware.com>
Message-ID: <E46DFE8E-9C21-45AB-AF58-BB3B6B32FB7B@restingparrotsoftware.com>

> Since POST can be used, that alone seemed to be a dealbreaker...

I guess you did address that. I would have assumed that to be impossible since it means buffering the request body in the load balancer, I just figured they'd rule that out of bounds. (Like in Apache, you can only read it once, so calling the APIs again won't work.)

-- Scott