Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP APM
Known Affected Versions:
12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5, 12.1.5.1, 12.1.5.2, 12.1.5.3, 12.1.6, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1
Fixed In:
13.1.0
Opened: Jun 19, 2016 Severity: 3-Major
This enhancement contains two parts: 1. BIG-IP as SAML IdP: When BIG-IP is used as SAML identity provider, processing of authentication requests from external service providers may fail if request does not contain required AssertionConsumerServiceURL or AssertionConsumerServiceIndex attributes, but instead contains unsupported 'ProtocolBinding' attribute. 2. BIG-IP as SAML SP: BIG-IP as service provider cannot be configured to send ProviderName element in authentication requests.
1. IdP will fail to process authentication request, and subsequently user authentication will fail. 2. Authentication request generated by BIG-IP as SP will not contain 'ProviderName' attribute.
1. BIG-IP is used as SAML IdP. Received from external SP authentication requests does not contain required AssertionConsumerServiceURL/AssertionConsumerServiceIndex attributes. 2. BIG-IP is used as SAML SP. Attempt to configure 'ProviderName' attribute to be send out to external IdP's with authentication requests.
None.
1. BIG-IP as IdP now supports processing of ProtocolBinding in authentication requests from external service providers. ProtocolBinding is a URI reference that identifies a SAML protocol binding to be used when returning the <Response> message. Attribute ProtocolBinding is mutually exclusive with the AssertionConsumerServiceIndex attribute and is typically accompanied by the AssertionConsumerServiceURL attribute. 2. BIG-IP as SP now supports configurable ProviderName attribute in BIG-IP's SAML 2.0 service provider configuration. ProviderName is an attribute in authentication request that may optionally specify the human-readable name of the requester for use by the presenter's user agent or the identity provider.