F5 APM

F5 BIG-IP Access Policy Manager (APM) SAML Setup

This guide walks through a basic setup for connecting Kasm to F5 BIG-IP Access Policy Manager (APM) SAML via SAML using Active Diretory as a backend. Active Directory user accounts are assumed to have a populated email address attribute. Also an LDAP Service account should be created in Active Directory already.

Prerequisites

Before starting the configuration, F5 BIG-IP should be enabled with Local Traffic (LTM) and Access Policy Manager (APM) feature.

Architecture

Here is the architecture for this deployment.

Signing Certificate

1. From the F5 BIG-IP console, select System, select Certificate Management, select Traffic Certificate Management, and select SSL Certificate List.
2. Click Create....
3. Enter Certificate settings:

Setting	Value
Name	Enter friendly name for identification
Issuer	Self
Common Name	Enter the hostname for the SAML Identity Provider, e.g. auth.internal.kasm
Division/Organization/Locality/State or Province/Country	Enter the relevant details as appropriate
Lifetime	Enter appropriate lifetime according to organization policy
Subject Alternative Name	Enter as DNS:<SAML Identity Provider hostname>

4. Click Finished.
5. Click on the newly created signing certificate. Click Export, and then copy the Certificate Text. This data will be used in the creation of the Kasm SAML configuration in the next section.

Create a new SAML configuration in Kasm

1. Log into the Kasm UI as an administrator.
2. Select Access Management -> Authentication -> SAML -> Add Configuration.
3. The SAML 2.0 Configuration page will auto-generate the Entity ID, Single Sign On Service, Single Logout Server, and Relay State values.
4. Update the form with the following entries.

Setting	Value
Service Provider	---
Enabled	Yes
Display Name	Enter friendly name for F5 SAML IdP
Host Name	Enter Kasm Workspaces host name
Default	Unchecked
Auto Login	Unchecked
Group Member Attribute	Leave empty
NameID Attribute	emailAddress
Debug	Checked Remark: Leave checked for more debug messages. Can be unchecked if confirmed everything is working.
Identity Provider	---
Entity Id	http://<F5 SAML IdP hostname>/idp
Single Sign On Service	https://<F5 SAML IdP hostname>/saml/idp/profile/redirectorpost/sso
Single Logout Service:	https://<F5 SAML IdP hostname>/saml/idp/profile/redirect/sls
X509 Certificate	Certificate data from the previous section
Advanced Settings	---
Want Attribute Statement	Checked
Send Requested Authn Context	Checked
Want Assertion Signed	Checked
Want Name ID	Checked
Signature Algorithm	http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
Digest Algorithm	http://www.w3.org/2001/04/xmlenc#sha256

6. Click Save to save the changes.
7. Click the Edit icon to re-open to SAML configuration. Leave this page open and continue to the next steps.

Upload or Confirm F5 iApp Guided Configurations package

1. From the F5 BIG-IP console, select iApps and select Package Management LX. Confirm f5-iappsix-access-framework and f5-iappsix-access-saml-idp exists.
2. If the package does not exist, download Access and Advanced WAF Guided Configuration packages under Guided Configuration product line in BIG-IP Group from MyF5 page. Go back to the Package Management LX console, click Import..., select the package and click Upload. Repeat the upload for the next package.
3. Confirm the f5-iappsix-access-framework and f5-iappsix-access-saml-idp packages are installed.

Import TLS certificate for SAML Identity Provider

1. From the F5 BIG-IP console, select System, select Certificate Management, select Traffic Certificate Management, and select SSL Certificate List.
2. Import TLS certificate key in PEM format.

• Click Import.
• Select Import Type as Key.
• Click Choose File.... Select certificate key file.
• Click Import.

3. Import TLS certificate in PEM format.

• Click Import.
• Select Import Type as Certificate.
• Click Choose File.... Select certificate file.
• Click Import.

4. Ensure the TLS certificate key and certificate are properly imported.
5. Select Local Traffic, select Profiles, select SSL, and select Client.

• Click Create....
• Update the form with the following entries. For rows where Custom is enabled, remember to click the checkbox on the right hand side.

Setting	Value	Custom
Name	Enter friendly name for the Client SSL Profile	Not Applicable
Certificate Key Chain	Click Add. Select the TLS certificate imported in last section for the certificate. Remember this is not the signing certificate. Select the TLS certificate key.	Yes

• Click Finished.

F5 Guided Configuration

1. From the F5 BIG-IP console, select Access and then select Guided Configuration.
2. Click Federation.
3. Click SAML Identity Provider for Applications.
4. Click Next in the page of Configuration Example.
5. Update the Identity Provider Properties form with the following entries.

Setting	Value
Configuration Name	Enter friendly name for the configuration
Entity Id	http://<F5 SAML IdP hostname>/idp
Scheme	https
Host Name	<F5 SAML IdP hostname>
Assertion Properties \ Signing Key	Select the IdP signing certificate key previously imported
Assertion Properties \ Signing Certificate	Select the IdP signing certificate previously imported

Click Save & Next.

6. Update the Virtual Server Properties form with the following entries.

Setting	Value
Destination Address	Enter F5 SAML IdP Virtual Server IP address
Service Port	443 / HTTPS
Enable Redirect Port	Checked
Redirect Port	80 / HTTP
Client SSL Profile	Select Use Existing / Add previously created Client SSL Profile

Click Save & Next.

7. Update the Authentication Properties form with the following entries.

Setting	Value
Choose Authentication Server Type	Active Directory
Choose New Authentication Server	Create New
Authentication Server Properties \ Domain Name	Enter Active Directory domain name
Server Connection	Direct
Domain Controller	Enter Domain Controller IP address
Admin Name	Enter the service account for authenticating users in Active Directory using LDAP
Admin Password	Enter the password for the above service account
Verify Admin Password	Enter the password for the above service account again

Click Save & Next.

8. Click Save & Next on the Multi Factor Authentication form.
9. Click Add Application on the Configured Application List form.
10. Update the Authentication Properties form with the following entries.

Setting	Value
Select method to configure your application	Custom
Application Name	Enter friendly application name
IdP Initiated SSO	No
Create New or pick existing SP Connector	Create New
Service Provider Name	Enter friendly Service Provider Name
Entity ID	Copy Entity ID from Kasm administration panel under Access Management -> Authentication -> SAML. It should look like https://<Kasm Workspaces hostname>/api/metadata/?id=<Kasm generated ID>
Assertion Consumer Services	Select Default on Index 0. Copy Single Sign On Service from Kasm administration panel under Access Management -> Authentication -> SAML to Location URL. It should look like https://<Kasm Workspaces hostname>/api/acs/?id=<Kasm generated ID> Keep Binding to POST.

Click Save.

11. Click on the newly created application. Click on Show Advanced Setting to modify properties previously hidden.
12. Select Yes on Does SaaS application require SAML attributes?
13. Update the Authentication Properties form with the following entries.

Setting	Value
SAML Attributes \ Attribute Name	NameID
SAML Attributes \ Attribute Value	emailAddress
Single Logout Service Settings \ Single Logout Request URL	Copy Single Logout Service from Kasm administration panel under Access Management -> Authentication -> SAML to Location URL. It should look like https://<Kasm Workspaces hostname>/api/slo/?id=<Kasm generated ID>
Single Logout Service Settings \ Single Logout Response URL	Copy Single Logout Service from Kasm administration panel under Access Management -> Authentication -> SAML to Location URL. It should look like https://<Kasm Workspaces hostname>/api/slo/?id=<Kasm generated ID>
Single Logout Service Settings \ Single Logout Binding	POST

Click Save.

14. Click Save & Next on the next three screens, including Endpoint Checks Properties, Customization Properties and Session Management Properties.
15. Click Deploy.
16. Click Finish. Confirm the application has a Deployed status.
17. In the Kasm Workspaces login screen, there will be a new button for login via F5 APM. Click to test the new SAML authentication method.

Configuration Video Tutorial

This video walks through configuring F5 APM SAML Identity Provider as discussed above.