apm aaa saml-idp-connector
apm aaa saml-idp-connector(1) BIG-IP TMSH Manual apm aaa saml-idp-connector(1)
NAME
saml-idp-connector - Specify saml idp connector configuration used for SAML authentication.
MODULE
apm aaa
SYNTAX
Configure the saml-idp-connector component within the aaa module using the syntax shown in the following
sections.
CREATE/MODIFY
create saml-idp-connector [name]
modify saml-idp-connector [name]
options:
app-service [[string] | none]
artifact-resolution-service-addr [IP address]
artifact-resolution-service-port [integer]
artifact-resolution-service-url [[string] | none]
basic-auth-password [[string] | none]
basic-auth-username [[string] | none]
description [[string] | none]
entity-id [string]
identity-location [attribute | subject]
identity-location-attribute [[string] | none]
idp-certificate [[string] | none]
import-metadata [[metadata-file] | none]
location-specific [ true | false ]
metadata-cert [[string] | none]
name-qualifier [[string] | none]
serverssl-profile-name [profile name | none]
sign-artifact-resolution-rq [true | false]
single-logout-binding
single-logout-response-uri [[string] | none]
single-logout-uri [[string] | none]
sso-binding [http-post | http-redirect]
sso-uri [[string] | none]
want-authn-request-signed [true | false]
want-detached-signature [true | false]
edit saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list saml-idp-connector
list saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml-idp-connector
show running-config saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete saml-idp-connector [name]
DESCRIPTION
You can use the saml-idp-connector to create and manage saml idp connectors.
EXAMPLES
create saml-idp-connector my_idp_connector { import-metadata /shared/tmp/meta_data_idp.xml}
Creates saml idp connector named my_idp_connector from metadata. In this example
"/shared/tmp/meta_data_idp.xml" is a file containing saml identity provider metadata.
create saml-idp-connector my_idp_connector1 { entity-id "https://www.secureauth.com/dom1" identity-location
subject sso-binding http-post sso-uri "https://www.secureauth.com/dom1/acs/" idp-certificate my_company.crt}
Creates a saml idp connector named my_idp_connector1 with certificate "my_company.crt" with identity-
location "subject".
list saml-idp-connector
Displays a list of saml idp connectors.
delete saml-idp-connector my_idp_connector
Deletes the my_idp_connector saml idp connector.
OPTIONS
app-service
Specifies the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
artifact-resolution-service-addr
Specifies the IP address that this BIG-IP as SP will use to connect to the IdP artifact resolution
service. Value must be a valid IPv4 or IPv6 address.
artifact-resolution-service-port
Specifies the port that this BIG-IP as SP will use to connect to the IdP artifact resolution service.
artifact-resolution-service-url
Specifies the URI of the IdP artifact resolution service. The URI must include protocol, hostname, and
full path.
basic-auth-password
Specifies the password for basic authentication. When configured, basic authentication is used for the
artifact resolve request sent to the IdP.
basic-auth-username
Specifies username for basic authentication. When configured, basic authentication is used for the
artifact resolve request sent to the IdP.
description
Specifies a unique description for the saml idp connector. The default is none.
entity-id
Specifies unique URI to represent the IdP pointed by idp connector.
identity-location
Specifies location of user identity inside SAML assertion. It can be either one of the attributes or the
subject.
identity-location-attribute
If the location of user identity is set to attribute then attribute name should be specified as part of
this attribute.
idp-certificate
This is IdP's certificate and is used by BIG-IP as SP to verify the signature of the assertion.
import-metadata
This attribute specifies the metadata file from an external IdP system used for creating idp connector
object.
For example: create saml-idp-connector my_idp_connector { import-metadata /shared/tmp/meta_data_idp.xml}
location-specific
Objects of this class might have location specific attribute(s). Admin can indicate if object is location
specific by setting it to true.
metadata-cert
This specifies the certificate to use to verify the signature of metadata imported from a file.
For example: create saml-idp-connector my_idp_connector2 {import-metadata
/shared/tmp/meta_data_signed_idp.xml metadata-cert default.crt}
name-qualifier
Specifies the security or administrative domain of the external IdP. This value usually matches IdP
Entity ID.
serverssl-profile-name
Specifies the SSL profile used when this BIG-IP as SP connects to the IdP artifact resolution service.
sign-artifact-resolution-rq
Specifies whether the IdP requires artifact resolve requests to be signed. Default value is true.
single-logout-binding
This attribute is reserved for future functionality.
single-logout-response-uri
A URI where this BIG-IP as SP will send single logout (SLO) responses.
single-logout-uri
A URI where this BIG-IP as SP will send single logout (SLO) requests.
sso-binding
This specifies the method the IdP uses to receive authentication request from BIG-IP as SP. Default
value is http-post
sso-uri
This specifies the URL of IdP's SSO service where BIG-IP as SP sends an authentication request to IdP.
want-authn-request-signed
This property specifies whether IdP requires signed authentication request. Set it to true if this BIG-IP
as SP is required to send signed authentication request to IdP. Default value is false.
want-detached-signature
This property specifies signature type for messages sent by BIG-IP via HTTP Redirect binding. To use
detached signatures set this property to true. Enveloped signatures are used by default.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2012-2013, 2016. All rights reserved.
BIG-IP 2017-04-25 apm aaa saml-idp-connector(1)