apm aaa saml-idp-connector
apm aaa saml-idp-connector(1) BIG-IP TMSH Manual apm aaa saml-idp-connector(1)
NAME
saml-idp-connector - Specify saml idp connector configuration used for
SAML authentication.
MODULE
apm aaa
SYNTAX
Configure the saml-idp-connector component within the aaa module using
the syntax shown in the following sections.
CREATE/MODIFY
create saml-idp-connector [name]
modify saml-idp-connector [name]
options:
app-service [[string] | none]
artifact-resolution-service-addr [IP address]
artifact-resolution-service-port [integer]
artifact-resolution-service-url [[string] | none]
basic-auth-password [[string] | none]
basic-auth-username [[string] | none]
description [[string] | none]
entity-id [string]
identity-location [attribute | subject]
identity-location-attribute [[string] | none]
idp-certificate [[string] | none]
import-metadata [[metadata-file] | none]
location-specific [ true | false ]
metadata-cert [[string] | none]
serverssl-profile-name [profile name | none]
sign-artifact-resolution-rq [true | false]
single-logout-binding
single-logout-response-uri [[string] | none]
single-logout-uri [[string] | none]
sso-binding [http-post | http-redirect]
sso-uri [[string] | none]
want-authn-request-signed [true | false]
want-detached-signature [true | false]
edit saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list saml-idp-connector
list saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml-idp-connector
show running-config saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete saml-idp-connector [name]
DESCRIPTION
You can use the saml-idp-connector to create and manage saml idp
connectors.
EXAMPLES
create saml-idp-connector my_idp_connector { import-metadata
/shared/tmp/meta_data_idp.xml}
Creates saml idp connector named my_idp_connector from metadata.
In this example "/shared/tmp/meta_data_idp.xml" is a file
containing saml identity provider metadata.
create saml-idp-connector my_idp_connector1 { entity-id
"https://www.secureauth.com/dom1" identity-location subject sso-binding
http-post sso-uri "https://www.secureauth.com/dom1/acs/" idp-
certificate my_company.crt}
Creates a saml idp connector named my_idp_connector1 with
certificate "my_company.crt" with identity-location "subject".
list saml-idp-connector
Displays a list of saml idp connectors.
delete saml-idp-connector my_idp_connector
Deletes the my_idp_connector saml idp connector.
OPTIONS
app-service
Specifies the name of the application service to which the object
belongs. The default value is none. Note: If the strict-updates
option is enabled on the application service that owns the object,
you cannot modify or delete the object. Only the application
service can modify or delete the object.
artifact-resolution-service-addr
Specifies the IP address that this BIG-IP as SP will use to
connect to the IdP artifact resolution service. Value must be a
valid IPv4 or IPv6 address.
artifact-resolution-service-port
Specifies the port that this BIG-IP as SP will use to connect to
the IdP artifact resolution service.
artifact-resolution-service-url
Specifies the URI of the IdP artifact resolution service. The URI
must include protocol, hostname, and full path.
basic-auth-password
Specifies the password for basic authentication. When configured,
basic authentication is used for the artifact resolve request sent
to the IdP.
basic-auth-username
Specifies username for basic authentication. When configured,
basic authentication is used for the artifact resolve request sent
to the IdP.
description
Specifies a unique description for the saml idp connector. The
default is none.
entity-id
Specifies unique URI to represent the IdP pointed by idp
connector.
identity-location
Specifies location of user identity inside SAML assertion. It can
be either one of the attributes or the subject.
identity-location-attribute
If the location of user identity is set to attribute then
attribute name should be specified as part of this attribute.
idp-certificate
This is IdP's certificate and is used by BIG-IP as SP to verify
the signature of the assertion.
import-metadata
This attribute specifies the metadata file from an external IdP
system used for creating idp connector object.
For example: create saml-idp-connector my_idp_connector { import-
metadata /shared/tmp/meta_data_idp.xml}
location-specific
Objects of this class might have location specific attribute(s).
Admin can indicate if object is location specific by setting it to
true.
metadata-cert
This specifies the certificate to use to verify the signature of
metadata imported from a file.
For example: create saml-idp-connector my_idp_connector2
{import-metadata /shared/tmp/meta_data_signed_idp.xml metadata-
cert default.crt}
serverssl-profile-name
Specifies the SSL profile used when this BIG-IP as SP connects to
the IdP artifact resolution service.
sign-artifact-resolution-rq
Specifies whether the IdP requires artifact resolve requests to be
signed. Default value is true.
single-logout-binding
This attribute is reserved for future functionality.
single-logout-response-uri
A URI where this BIG-IP as SP will send single logout (SLO)
responses.
single-logout-uri
A URI where this BIG-IP as SP will send single logout (SLO)
requests.
sso-binding
This specifies the method the IdP uses to receive authentication
request from BIG-IP as SP. Default value is http-post
sso-uri
This specifies the URL of IdP's SSO service where BIG-IP as SP
sends an authentication request to IdP.
want-authn-request-signed
This property specifies whether IdP requires signed authentication
request. Set it to true if this BIG-IP as SP is required to send
signed authentication request to IdP. Default value is false.
want-detached-signature
This property specifies signature type for messages sent by BIG-IP
via HTTP Redirect binding. To use detached signatures set this
property to true. Enveloped signatures are used by default.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or
by any means, electronic or mechanical, including photocopying,
recording, or information storage and retrieval systems, for any
purpose other than the purchaser's personal use, without the express
written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2012-2013, 2016. All rights
reserved.
BIG-IP 2016-03-14 apm aaa saml-idp-connector(1)