SAML authentication

Overview

Use a supported SAML identity provider to authenticate with F5 Insight. This guide covers shared SAML settings and an Okta-specific configuration procedure. It doesn’t provide a Ping-specific walkthrough.

Before you begin

  • You have an administrator account in F5 Insight.
  • You have access to configure the SAML application in your identity provider.
  • You have the provider metadata XML or metadata URL.

Configure a group-to-role mapping before testing user access. Enter the exact asserted group value, such as admins, not the attribute name. Matching is case-sensitive. F5 Insight blocks access when no role is found. See External authentication and role-based access control.

Important

If there’s any risk of username collisions, don’t use local and external users together. Keep external usernames distinct from all local usernames.

Avoid the external username admin. F5 Insight assigns Admin to that username regardless of remote role mappings.

When a local and an external username collide, you can no longer manage the local user or reset the local password. For example, after an external admin login, the local admin account disappears from the user list. See Known authentication issues.

Note

Reset Password appears for external users, but password resets apply only to local users. Manage external passwords through your identity provider.

Configuring a SAML provider

  1. Log in to F5 Insight as an administrator.
  2. Navigate to Settings ‣ User Administration ‣ SSO Identity Providers.
  3. Select SAML.
  4. Fill in the required configuration fields:
Field Description Required
Name Display name for the provider (appears on the login screen) Yes
Metadata XML / URL SAML metadata obtained from the IdP (Ping or Okta) Yes
Binding SAML binding type: POST or Redirect Yes
  1. Select Save to store the configuration.
  2. Select Create to enable the provider on the login screen.

Note

The administrator must first configure F5 Insight as a trusted Service Provider on the IdP (Ping or Okta), obtain the SAML metadata XML or URL, and then paste it into the F5 Insight configuration.

Configure Okta

Initial F5 Insight for Okta

  1. Log in to F5 Insight as an administrator.
  2. Navigate to System Management -> User Administration -> SSO/Identity Providers.
  3. Select SAML from the available providers.
  4. Provide a name, metadata XML or metadata URL, and binding.

Note

We recommend to create the Okta application before starting this step. When initially creating the Okta SAML 2.0 application, the IAM administrator must supply placeholder values for Single Sign-On URL and Audience URI (SP Entity ID), for example https://<insight_fqdn_or_ip>. This allows working Metadata URL or XML values from the Okta app to be entered during F5 Insight provider setup.

Example App Values

Property Value
App Type SAML 2.0
App Name F5 Insight
Single sign-on URL https://<f5insight_fqdn_or_ip>
Audience URI (SP Entity ID) https://<f5insight_fqdn_or_ip>
Name Format EmailAddress
Application Username Email
  1. Save the provider.
  2. Select Edit for the new provider and expand the SAML Metadata section.
  3. Note the following values from F5 Insight:
    • SAML Metadata URL (Audience URI / SP Entity ID)
    • SAML ACS Intent API URL (Single sign-on URL)

Update the Okta application

  1. Log in to the Okta Admin Console and navigate to Applications.
  2. Select the previously created application.
  3. Configure SAML settings:
    • Single Sign-On URL: Paste the SAML ACS Intent API URL copied from F5 Insight.
    • Audience URI (SP Entity ID): Paste the SAML Metadata URL copied from F5 Insight.
  4. Go to Attribute Statements and add the required user attributes (set format to Basic).
Name Value
email user.email
lastname user.lastName
firstname user.firstName
username user.email
displayname user.displayName
  1. Add a Group Attribute Statement:
    • Name: groups
    • Name format: Unspecified
    • Filter: Select Matches regex and input .*
  2. Save the application.

SAML login

  1. Navigate to the F5 Insight login page.
  2. Select Sign in with <SAML Provider Name> (for example, “Log in with Okta” or “log in with Ping”).
  3. You are redirected to an intermediate authentication screen.
  4. On the intermediate screen, select the SAML log-in option again to proceed to the IdP authentication page.
  5. Enter the SAML credentials on the IdP authentication page.
  6. Upon successful authentication, you are redirected to the F5 Insight dashboard with permissions based on your assigned role.

Example - SAML role mapping (Okta / Ping)

SAML User Group Attribute in Assertion F5 Insight Role
admin@example.com admins Admin
operator@example.com operators Operator
viewer@example.com viewers Viewer
user@example.com (no group attribute) No role; access denied