Last Modified: Oct 29, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 16.1.6, 16.1.6.1
Opened: Apr 24, 2023 Severity: 3-Major
When Access Policy Manager (APM) is configured with Windows Logon Integration (WLI), SAML authentication, and Azure AD as the Identity Provider (IdP), logging off the Windows workstation initiates a SAML Single Logout (SLO) request but does not terminate the associated APM session. The APM session remains active on the BIG-IP system until the configured idle timeout or maximum session timeout is reached
APM sessions persist after the user logs out of Windows, resulting in stale sessions remaining active until timeout
- BIG-IP APM configured with Windows Logon Integration (WLI). SAML authentication is used within the access policy - Azure AD (Microsoft Entra ID) is configured as the SAML Identity Provider - A Network Access (NA) resource is assigned through the access policy - Edge Client/Dial-Up connection is configured with Enforce Access Policy in Custom Dialer enabled -The user logs off the Windows workstation while the Network Access session is active - SAML Single Logout (SLO) is initiated, but the APM session is not explicitly removed
None
None