add policy patset ps_samlauth_b64
bind policy patset ps_samlauth_b64 "UHJlZml4TGlz" -index 1
bind policy patset ps_samlauth_b64 "ZWZpeExp" -index 2
bind policy patset ps_samlauth_b64 "cmVmaXhMaXN0" -index 3
bind policy patset ps_samlauth_b64 "SW5jbHVzaXZlTmFtZXNwYWNl" -index 4
bind policy patset ps_samlauth_b64 "Y2x1c2l2ZU5hbWVzcGFj" -index 5
bind policy patset ps_samlauth_b64 "bmNsdXNpdmVOYW1lc3BhY2Vz" -index 6
add policy patset ps_samlauth_words
bind policy patset ps_samlauth_words "PrefixList" -index 1
bind policy patset ps_samlauth_words "InclusiveNamespaces" -index 2
add audit messageaction act_samlblock2_log INFORMATIONAL "\"SAMLBLOCK2 src=\" + CLIENT.IP.SRC + \" vip=\" + CLIENT.IP.DST + \" host=\" + HTTP.REQ.HOSTNAME + \" method=\" + HTTP.REQ.METHOD + \" path=\" + HTTP.REQ.URL.PATH + \" clen=\" + HTTP.REQ.HEADER(\"Content-Length\") + \" te=\" + HTTP.REQ.HEADER(\"Transfer-Encoding\") + \" ua=\" + HTTP.REQ.HEADER(\"User-Agent\")"
add responder policy pol_samlauth_block_v2 "HTTP.REQ.URL.PATH.SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.CONTAINS(\"samlauth\") && (HTTP.REQ.CONTENT_LENGTH.GT(32768) || HTTP.REQ.HEADER(\"Transfer-Encoding\").EXISTS || HTTP.REQ.URL.QUERY.SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.CONTAINS(\"SAMLResponse\") || (HTTP.REQ.METHOD.EQ(POST) && HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.CONTAINS(\"SAMLResponse=\").NOT) || HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.AFTER_STR(\"SAMLResponse=\").CONTAINS(\"SAMLResponse=\") || HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS_ANY(\"ps_samlauth_b64\") || HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.AFTER_STR(\"SAMLResponse=\").BEFORE_STR(\"&\").B64DECODE.SET_TEXT_MODE(IGNORECASE).CONTAINS_ANY(\"ps_samlauth_words\"))" DROP DROP -logAction act_samlblock2_log

2. Binds (B_v2_bind.txt): the Gateway vserver and the authentication vserver behind it, AAA_REQUEST, priority 90

bind vpn vserver AAAA_AG -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind vpn vserver BBBB_AG -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind vpn vserver CCCC_AG -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind vpn vserver DDDD_AG -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind authentication vserver AAAA_SAML_vServer -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind authentication vserver BBBB_SAML_vServer -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind authentication vserver CCCC_SAML_vServer -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
bind authentication vserver DDDD_SAML_vServer -policy pol_samlauth_block_v2 -type AAA_REQUEST -priority 90
save ns config