Solution14 Policy¶

Per-Session Policy Walk-Through¶

This solution requires creation of two access policies. A default allow per-session policy and a per-request policy using two subroutines.

This initial access policy (default allow) is a per-session policy to populate required session variable name and values.

Per-Request Policy Walk-Through¶

This per-request access policy accepts users request and redirect them to one of the two SAML Auth Subroutines configured for sp.acme.com or sp1.acme.com.

Per-Request Policies are an extension of a per-session policy by enabling fine-grain control over a users session on request by request basis.

This URL Branching action is used to interrogate the service URL and vector it to the appropriate SAML-SP Subroutine.
When a user is directed to a SAML Auth agent they are redirected to the IDP selected by the SP Service(sp.acme.com).
Upon successful authentication at the IDP, the user is redirected back to the SP. The SP service consumes the Assertion. The user is directed to the Success Terminal.
Upon unsuccessful authentication, the user proceeds down the fallback branch and directed to the Fail Terminal.
Pool sp.acme.com-pool is assigned to the request for load balancing. Traitional LTM load balancing rules still apply.
The user is granted access via the Allow Terminal.
User credentials failed the selected authentication and is directed to the Reject Terminal.
When a user is directed to a SAML Auth agent they are redirected to the IDP selected by the SP Service(sp1.acme.com).
Upon successful authentication at the IDP, the user is redirected back to the SP. The SP service consumes the Assertion. The user is directed to the Success Terminal.
Upon unsuccessful authentication, the user proceeds down the fallback branch and directed to the Fail Terminal.
Pool sp1.acme.com-pool is assigned to the request for load balancing. Traitional LTM load balancing rules still apply.
The user is granted access via the Allow Terminal.
User credentials failed the selected authentication and is directed to the Reject Terminal.
Users request did not meet either of Subroutine URI requirements.