Bug ID 495265: SAML IdP and SP configured in same access profile not supported

Last Modified: Oct 01, 2018

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.2, 11.5.2 HF1, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4

Fixed In:
12.0.0, 11.6.0 HF5, 11.5.3, 11.4.1 HF9

Opened: Dec 08, 2014
Severity: 3-Major

Symptoms

SLO might not work properly under certain conditions. When a user attempts to start SLO, the connection gets reset. The system logs messages such as the following: RST sent from x.x.x.x:433 to x.x.x.x:xxxx, [0xxxxxx:xxx] Internal error ((APM::SSO) Error in reading sp info from session db failed)

Impact

SLO is not properly executed; users's session might not be terminated.

Conditions

All conditions must be met: 1. Both BIG-IP as SP and BIG-IP as IdP are configured on the same access profile. 2. SLO is configured for both BIG-IP as IdP and BIG-IP as SP. 3. SLO is executed in multiple TCP sessions between the user's browser and the BIG-IP system.

Workaround

None.

Fix Information

A problem with SAML single-logout has been fixed.

Behavior Change