Bug ID 702263: An access profile with large number of SAML Resources (greater than 200) causes APM error ERR_TOOBIG while loading.

Last Modified: May 14, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3

Fixed In:
14.0.0, 13.1.0.4

Opened: Jan 16, 2018
Severity: 3-Major

Symptoms

Using a SAML SP-initiated use case (APM is IdP) and having a large Access Policy with 200 or more SAML resources assigned to users. Each time a new SAML resource is added to that Access Policy, the entire SSO service becomes unusable. No new sessions can be established. The system generates internal metadata that consists of the names of all the SAML resources along with its SSO name. This has a limit of size 4 KB. When this limit is reached, the system logs errors similar to the following: -- err tmm3[15840]: 01490514:3: (null):Common:00000000: Access encountered error: ERR_TOOBIG. File: ../modules/hudfilter/access/access.c, Function: access_create_saml_meta_data, Line: 21001 -- err tmm3[15840]: 014d1014:3: /Common/SAML_SSO_access:Common:7a34161c:SAML SSO: Error(16) Unable to find SAML SSO/SP Connector object matching SAML Authn Request.

Impact

The system logs an error on running the Access Policy, the whole SSO service becomes unusable. No new sessions can be established.

Conditions

A SAML SSO Access policy has a large number of SAML Resources assigned to it (such that the combined length of their names is greater-than-or-equal-to 4 KB).

Workaround

Delete any unused SAML resources from SAML SSO access policy so that the combined length of the names of all SAML resources assigned to Access policy is less than 4 KB.

Fix Information

The system now allocate memory dynamically for the internally stored metadata, so it can handle large lists of assigned SAML resource objects.

Behavior Change