apm aaa saml-idp-connector
apm aaa saml-idp-connector(1) BIG-IP TMSH Manual apm aaa saml-idp-connector(1)
NAME
saml-idp-connector - Specify saml idp connector configuration used for SAML authentication.
MODULE
apm aaa
SYNTAX
Configure the saml-idp-connector component within the aaa module using the syntax shown in the following sections.
CREATE/MODIFY
create saml-idp-connector [name]
modify saml-idp-connector [name]
options:
app-service [[string] | none]
artifact-resolution-service-addr [IP address]
artifact-resolution-service-port [integer]
artifact-resolution-service-url [[string] | none]
basic-auth-password [[string] | none]
basic-auth-username [[string] | none]
description [[string] | none]
entity-id [string]
identity-location [attribute | subject]
identity-location-attribute [[string] | none]
idp-certificate [[string] | none]
import-metadata [[metadata-file] | none]
location-specific [ true | false ]
metadata-cert [[string] | none]
name-qualifier [[string] | none]
serverssl-profile-name [profile name | none]
sign-artifact-resolution-rq [true | false]
single-logout-binding
single-logout-response-uri [[string] | none]
single-logout-uri [[string] | none]
sso-binding [http-post | http-redirect]
sso-uri [[string] | none]
want-authn-request-signed [true | false]
want-detached-signature [true | false]
edit saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list saml-idp-connector
list saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml-idp-connector
show running-config saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete saml-idp-connector [name]
DESCRIPTION
You can use the saml-idp-connector to create and manage saml idp connectors.
EXAMPLES
create saml-idp-connector my_idp_connector { import-metadata /shared/tmp/meta_data_idp.xml}
Creates saml idp connector named my_idp_connector from metadata. In this example "/shared/tmp/meta_data_idp.xml" is a
file containing saml identity provider metadata.
create saml-idp-connector my_idp_connector1 { entity-id "https://www.secureauth.com/dom1" identity-location subject sso-
binding http-post sso-uri "https://www.secureauth.com/dom1/acs/" idp-certificate my_company.crt}
Creates a saml idp connector named my_idp_connector1 with certificate "my_company.crt" with identity-location
"subject".
list saml-idp-connector
Displays a list of saml idp connectors.
delete saml-idp-connector my_idp_connector
Deletes the my_idp_connector saml idp connector.
OPTIONS
app-service
Specifies the name of the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the application service that owns the object, you cannot modify or delete the
object. Only the application service can modify or delete the object.
artifact-resolution-service-addr
Specifies the IP address that this BIG-IP as SP will use to connect to the IdP artifact resolution service. Value must
be a valid IPv4 or IPv6 address.
artifact-resolution-service-port
Specifies the port that this BIG-IP as SP will use to connect to the IdP artifact resolution service.
artifact-resolution-service-url
Specifies the URI of the IdP artifact resolution service. The URI must include protocol, hostname, and full path.
basic-auth-password
Specifies the password for basic authentication. When configured, basic authentication is used for the artifact
resolve request sent to the IdP.
basic-auth-username
Specifies username for basic authentication. When configured, basic authentication is used for the artifact resolve
request sent to the IdP.
description
Specifies a unique description for the saml idp connector. The default is none.
entity-id
Specifies unique URI to represent the IdP pointed by idp connector.
identity-location
Specifies location of user identity inside SAML assertion. It can be either one of the attributes or the subject.
identity-location-attribute
If the location of user identity is set to attribute then attribute name should be specified as part of this
attribute.
idp-certificate
This is IdP's certificate and is used by BIG-IP as SP to verify the signature of the assertion.
import-metadata
This attribute specifies the metadata file from an external IdP system used for creating idp connector object.
For example: create saml-idp-connector my_idp_connector { import-metadata /shared/tmp/meta_data_idp.xml}
location-specific
Objects of this class might have location specific attribute(s). Admin can indicate if object is location specific by
setting it to true.
metadata-cert
This specifies the certificate to use to verify the signature of metadata imported from a file.
For example: create saml-idp-connector my_idp_connector2 {import-metadata /shared/tmp/meta_data_signed_idp.xml
metadata-cert default.crt}
name-qualifier
Specifies the security or administrative domain of the external IdP. This value usually matches IdP Entity ID.
serverssl-profile-name
Specifies the SSL profile used when this BIG-IP as SP connects to the IdP artifact resolution service.
sign-artifact-resolution-rq
Specifies whether the IdP requires artifact resolve requests to be signed. Default value is true.
single-logout-binding
This attribute is reserved for future functionality.
single-logout-response-uri
A URI where this BIG-IP as SP will send single logout (SLO) responses.
single-logout-uri
A URI where this BIG-IP as SP will send single logout (SLO) requests.
sso-binding
This specifies the method the IdP uses to receive authentication request from BIG-IP as SP. Default value is http-
post
sso-uri
This specifies the URL of IdP's SSO service where BIG-IP as SP sends an authentication request to IdP.
want-authn-request-signed
This property specifies whether IdP requires signed authentication request. Set it to true if this BIG-IP as SP is
required to send signed authentication request to IdP. Default value is false.
want-detached-signature
This property specifies signature type for messages sent by BIG-IP via HTTP Redirect binding. To use detached
signatures set this property to true. Enveloped signatures are used by default.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2012-2013, 2016. All rights reserved.
BIG-IP 2017-04-25 apm aaa saml-idp-connector(1)