Lab 5: SAML Identity Provider (IdP) - Certificate Auth

Task 1 - Setup Lab Environment

To access your dedicated student lab environment, you will need a web browser and Remote Desktop Protocol (RDP) client software. The web browser will be used to access the Unified Demo Framework (UDF) Training Portal. The RDP client will be used to connect to the jumphost, where you will be able to access the BIG-IP management interfaces (HTTPS, SSH).

1. Click DEPLOYMENT located on the top left corner to display the environment

2. Click ACCESS next to jumphost.f5lab.local

   

3. Select your RDP resolution.

4. The RDP client on your local host establishes a RDP connection to the Jump Host.

5. Login with the following credentials:

   • User: f5lab\user1
   • Password: user1

6. After successful logon the Chrome browser will auto launch opening the site https://portal.f5lab.local. This process usually takes 30 seconds after logon.

7. Click the Classes tab at the top of the page.

   

8. Scroll down the page until you see 301 SAML Federation on the left

   

9. Hover over tile SAML Identity Provider (IdP) - Cert Auth. A start and stop icon should appear within the tile. Click the Play Button to start the automation to build the environment

10. The screen should refresh displaying the progress of the automation within 30 seconds. Scroll to the bottom of the automation workflow to ensure all requests succeeded. If you experience errors try running the automation a second time or open an issue on the Access Labs Repo.

    

Task 2 ‑ Configure the SAML Identity Provider (IdP)

IdP Service

1. Begin by selecting: Access ‑> Federation ‑> SAML Identity Provider ‑> Local IdP Services

2. Click the Create button (far right)

   

3. In the Create New SAML IdP Service dialog box, click General Settngs in the left navigation pane and key in the following:

   IdP Service Name:	idp.acme.com
   IdP Entity ID:	https://idp.acme.com

   

   Note

   The yellow box on “Host” will disappear when the Entity ID is entered

4. In the Create New SAML IdP Service dialog box, click Assertion Settings in the left navigation pane and key in the following:

   Assertion Subject Type:	Persistent Identifier (drop down)
   Assertion Subject Value:	%{session.logon.last.username} (drop down)
   Authentication Context Class Reference	urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI

   

5. In the Create New SAML IdP Service dialog box, click Security Settings in the left navigation pane and key in the following:

   Signing Key:	/Common/idp.acme.com (drop down)
   Signing Certificate:	/Common/idp.acme.com (drop down)

   Note

   The certificate and key were previously imported

6. Click OK to complete the creation of the IdP service

   

SP Connector

1. Click on External SP Connectors (under the SAML Identity Provider tab) in the horizontal navigation menu

2. Click specifically on the Down Arrow next to the Create button (far right)

3. Select From Metadata from the drop down menu

   

4. In the Create New SAML Service Provider dialogue box, click Browse and select the sp_acme_com.xml file from the Desktop of your jump host

5. In the Service Provider Name field, enter the following: sp.acme.com

6. Click OK on the dialog box

   

   Note

   The sp_acme_com.xml file was created previously. Oftentimes SP providers will have a metadata file representing their SP service. This can be imported to save object creation time as has been done in this lab.

7. Click on Local IdP Services (under the SAML Identity Provider tab) in the horizontal navigation menu

   

8. Select the Checkbox next to the previously created idp.acme.com and click the Bind/Unbind SP Connectors button at the bottom of the GUI

   

9. In the Edit SAML SP’s that use this IdP dialog, select the /Common/sp.acme.com SAML SP Connection Name created previously

10. Click the OK button at the bottom of the dialog box

    

11. Under the Access ‑> Federation ‑> SAML Identity Provider ‑> Local IdP Services menu you should now see the following (as shown):

    Name:	idp.acme.com
    SAML SP Connectors:	sp.acme.com

    

Task 3 - Create a SAML Resource

1. Begin by selecting Access ‑> Federation ‑> SAML Resources >> **Plus (+) Sign

   

2. In the New SAML Resource window, enter the following values:

   Name:	sp.acme.com
   SSO Configuration:	idp.acmem.com
   Caption:	sp.acme.com

3. Click Finished at the bottom of the configuration window

   

Task 4 - Create a Webtop

1. Select Access ‑> Webtops ‑> Webtop Lists >> Plus (+) Sign

   

2. In the resulting window, enter the following values:

   Name:	full_webtop
   Type:	Full (drop down)
   Minimize To Tray	uncheck

3. Click Finished at the bottom of the GUI

   

Task 5 - Create an OCSP Responder

1. Navigate to Access >> Authentication >> OCSP Responder >> Click the Plus (+) Sign.

   

2. Enter the following information for the OCSP Responder configuration:

   Name:	ocsp_servers
   Configuration:	Advanced
   URL:	http://dc1.f5lab.local
   Certificate Authority File	ca.f5lab.local
   Certificate Authority Path:	/ocsp
   Options:	Uncheck Nonce

3. Click Finished

   

Task 6 - Create an AAA LDAP Server

1. Navigate to Access >> Authentication >> LDAP >> Click the Plus (+) Sign.

   

2. Enter the following information for the LDAP Server configuration:

   Name:	ldap_servers
   Server Connection:	Use Pool
   Server Pool Name:	ldap_pool
   Server Addresses:	10.1.20.7
   Admin DN:	CN=admin,CN=Users,DC=f5lab,DC=local
   Admin Password:	admin

3. Click Finished

   

Task 7 - Create a SAML IdP Access Policy

1. Select Access ‑> Profiles/Policies ‑> Access Profiles (Per-Session Policies)

2. Click the Create button (far right)

   

3. In the New Profile window, enter the following information:

   Name:	idp.acme.com‑psp
   Profile Type:	All (drop down)
   Profile Scope:	Profile (default)
   Customization Type:	modern (default)

   

4. Scroll to the bottom of the New Profile window to the Language Settings section

5. Select English from the Factory Built‑in Languages menu on the right and click the Double Arrow (<<), then click the Finished button.

6. The Default Language should be automatically set

   

7. From the Access ‑> Profiles/Policies ‑> Access Profiles (Per-Session Policies) screen, click the Edit link on the previously created idp.acme.com-psp line

   

8. Click the Plus (+) Sign between Start and Deny

   

9. In the pop-up dialog box, select the Authentication tab and then select the Radio next to On-Demand Cert Auth, and click the Add Item button

   

10. Click Save in the resulting Logon Page dialog box

    

11. On the successful branch of the On-Demand Cert Auth Policy-Item click the Plus (+) Sign

    

12. In the pop-up dialog box, select the Authentication tab and then select the Radio next to OCSP Auth, and click the Add Item button

    

13. Select /Common/ocsp_servers from the OCSP Responder drop down menu.

14. Click Save at the bottom of the window

    

15. Click the Plus (+) Sign on the successful branch between OCSP Auth and Deny

    

16. In the pop-up dialog box, select the Assignment tab and then select the Radio next to Variable Assign, and click the Add Item button

    

17. Enter the Name upn_extract

18. Click Add new entry

19. Click Change

    

20. Enter the Custom Variable session.custom.upn

21. Select Custom Expresssion from the right drop down menu

22. Enter the text below for the custom expression.

    set x509e_fields [split [mcget {session.ssl.cert.x509extension}] "\n"];
    # For each element in the list:
    foreach field $x509e_fields {
    # If the element contains UPN:
    if { $field contains "othername:UPN" } {
    ## set start of UPN variable
    set start [expr {[string first "othername:UPN<" $field] +14}]
    # UPN format is <user@domain>
    # Return the UPN, by finding the index of opening and closing brackets, then use string range to get everything between.
    return [string range $field $start [expr { [string first ">" $field $start] - 1 } ] ];  } }
    #Otherwise return UPN Not Found:
    return "UPN-NOT-FOUND";
    

23. Click Finished

    

24. Click Save

    

25. Click the Plus (+) Sign between upn_extract and Deny

    

26. In the pop-up dialog box, select the Authentication tab and then select the Radio next to LDAP Query, and click the Add Item button

    

27. In the LDAP Query Properties window, enter the following information:

    Server:	/Common/ldap_servers (drop down)
    Search DN:	dc=f5lab,dc=local (drop down)
    SearchFilter:	(userPrincipalName=%{session.custom.upn})

28. Click Add new entry

29. Add sAMAAccountName to the list of Required Attributes

    

30. Click the Branch Rules tab

31. Click the X on the User Group Membership line

    

32. Click Add Branch Rule

    

33. Enter the name LDAP Query Passed

34. Click change

    

35. Click Add Expression

    

36. Select LDAP Query from the Context dropdown menu

37. Select LDAP Query Passed from the Condition dropdown menu

38. Click Add Expression

    

39. Click Finsished

    

40. Click Save

    

41. Click the Plus (+) Sign on the LDAP Query Passed branch between LDAP Query and Deny

    

42. In the pop-up dialog box, select the Assignment tab and then select the Radio next to Variable Assign, and click the Add Item button

    

43. Enter the Name set_username

44. Click Add new entry

45. Click Change

    

46. Enter the Custom Variable session.logon.last.username

47. Select Session Variable from the right drop down menu

48. Enter the session variable name session.ldap.last.attr.sAMAccountName

49. Click Finished

    

50. Click Save

    

51. Click the Plus (+) Sign between set_username and Deny

    

52. In the pop-up dialog box, select the Assignment tab and then select the Radio next to Advanced Resource Assign, and click the Add Item button

    

53. In the new Resource Assignment entry, click the Add/Delete link

    

54. In the resulting pop-up window, click the SAML tab, and select the Checkbox next to /Common/sp.acme.com

    

55. Click the Webtop tab, and select the Checkbox next to /Common/full_webtop

56. Click the Update button at the bottom of the window to complete the Resource Assignment entry

    

57. Click the Save button at the bottom of the Advanced Resource Assign window

    

58. In the Visual Policy Editor, select the Deny ending on the fallback branch following Advanced Resource Assign

    

59. In the Select Ending dialog box, selet the Allow radio button and then click Save

    

60. In the Visual Policy Editor, click Apply Access Policy (top left), and close the Visual Policy Editor

    

Task 8 - Create a Client-side SSL Profile

1. Navigate to Local Traffic ‑> Profile -> SSL -> Client. Click the Plus (+) Sign

   

2. Enter the Name idp.acme.com-clientssl

3. Check the custom box on the Certificate Key Chain Line

4. Click Add

   

5. Select acme.com-wildcard from the Certificate dropdown menu

6. Select acme.com-wildcard from the Key dropdown menu

7. Click Add

   

8. Check the custom box on the Trusted Certificate Authorities Line

9. Select ca.f5lab.local from the Trusted Certificate Authorities dropdown menu

10. Check the custom box on the Advertised Certificate Authorities Line

11. Select ca.f5lab.local from the Advertised Certificate Authorities dropdown menu

    

12. Click Finished

Task 9 - Create an IdP Virtual Server

1. Begin by selecting Local Traffic ‑> Virtual Servers -> Virtual Server List. Click the Plus (+) Sign

   

2. In the New Virtual Server window, enter the following information:

   General Properties
   Name:	idp.acme.com
   Destination Address/Mask:	10.1.10.102
   Service Port:	443

   

   Configuration
   HTTP Profile:	http (drop down)
   SSL Profile (Client)	idp.acme.com-clientssl

   

   Access Policy
   Access Profile:	idp.acme.com-psp

   

3. Scroll to the bottom of the configuration window and click Finished

Task 10 - Test the Configuration

1. From the jumphost, navigate to the SAML IdP you previously configured at https://idp.acme.com.

2. Select the user1 certificate

3. Click OK

   

4. Click sp.acme.com

   

5. You are then successfully logged into https://sp.acme.com and presented a webpage.

   

6. Review your Active Sessions (Access ‑> Overview ‑> Active Sessions­­­)

7. Review your Access Report Logs (Access ‑> Overview ‑> Access Reports)

Task 11 - Lab Cleanup

1. From a browser on the jumphost navigate to https://portal.f5lab.local

2. Click the Classes tab at the top of the page.

   

3. Scroll down the page until you see 301 SAML Federation on the left

   

4. Hover over tile SAML Identity Provider (IdP) - Cert Auth. A start and stop icon should appear within the tile. Click the Stop Button to trigger the automation to remove any prebuilt objects from the environment

5. The screen should refresh displaying the progress of the automation within 30 seconds. Scroll to the bottom of the automation workflow to ensure all requests succeeded. If you you experience errors try running the automation a second time or open an issue on the Access Labs Repo.

   

6. This concludes the lab.