SSO integration using F5 URI Rewrite
Hi,
We have recently implemented a SSO solution using SAML 2.0 which leverages F5 LTM to redirect requests to Service provider based on IDP posting URI. Please be advised that Pega is the SP application.
Here is how the flow works,
Hi,
We have recently implemented a SSO solution using SAML 2.0 which leverages F5 LTM to redirect requests to Service provider based on IDP posting URI. Please be advised that Pega is the SP application.
Here is how the flow works,
- User logins into IDP application and initiates a request to access service provider
- IDP generates assertion and post the requests
- F5 uses URI rewrite to look for posting URI and if it contains a specific keyword, redirect the request to the SP application for authentication and launching the application.
- The URI rewrite also ensures the URL is masked to show the IDP application domain (e.g. https://www.portal.com) not the SP Pega domain (https://www.pegahostUrl/prweb/)
That said, we would like to hear for feedback on this solution from this community and also get advised on challenges anyone faced going down this route.
*IDP - Identity Provider, SP - Service Provider
Accepted Solution
Pegasystems Inc.
US
Hi,
F5 Note:
One issue you may run into is PRPC generating URL's based on how it was accessed from the F5. In PRPC the pxThread page will have properties used in stream processing that reflect the https://www.pegahosturl/prweb .
See: https://pdn.pega.com/how-configure-reverse-proxy-server
You want to use Approach A with a F5 iRule: (Example only)
when HTTP_REQUEST {
HTTP::header insert PegaRULES-SetContextURI https://www.portal.com]/prweb/
}
Then the prconfig or DSS setting in PRPC: (Requires JVM restart to take affect .. "initialization")
<env name="Initialization/ContextRewriteEnabled" value="true" />
or
Owning Ruleset: Pega-Engine
Setting Purpose: prconfig/initialization/ContextRewriteEnabled/default
Value: true
With this in place any HTTP 303's PRPC generates will have the correct URL for the F5 level.
SAML Note:
Since you are using an IDP initiated request make sure you send us a RelayState parameter. This should contain the URL for what you want to access in PRPC.
End User Portal: (No pyActivity or pyStream parameter defaults to loading users default portal)
Hi,
F5 Note:
One issue you may run into is PRPC generating URL's based on how it was accessed from the F5. In PRPC the pxThread page will have properties used in stream processing that reflect the https://www.pegahosturl/prweb .
See: https://pdn.pega.com/how-configure-reverse-proxy-server
You want to use Approach A with a F5 iRule: (Example only)
when HTTP_REQUEST {
HTTP::header insert PegaRULES-SetContextURI https://www.portal.com]/prweb/
}
Then the prconfig or DSS setting in PRPC: (Requires JVM restart to take affect .. "initialization")
<env name="Initialization/ContextRewriteEnabled" value="true" />
or
Owning Ruleset: Pega-Engine
Setting Purpose: prconfig/initialization/ContextRewriteEnabled/default
Value: true
With this in place any HTTP 303's PRPC generates will have the correct URL for the F5 level.
SAML Note:
Since you are using an IDP initiated request make sure you send us a RelayState parameter. This should contain the URL for what you want to access in PRPC.
End User Portal: (No pyActivity or pyStream parameter defaults to loading users default portal)
https://www.oracle.com/content-management/webcenter-portal/
Snap Start:
https://www.oracle.com/content-management/webcenter-portal/?pyActivity=snapstart¶m1=value1
Health Alliance Plan
US
Chris, Appreciate your time and thorough feedback in highlighting the challenges. Yes we ran into these issues and later corrected our configurations on both set context URI and prconfig to make the solution work.
However we would also like to get advised if this would be a preferred and recommended solution.