1. Create a file have below content root@ns# cat /var/saml_protection_v1.txt add responder policy pol_samlauth_prefixlist_block "HTTP.REQ.URL.PATH.SET_TEXT_MODE(IGNORECASE).EQ(\"/cgi/samlauth\") && (HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.AFTER_STR(\"SAMLResponse=\").AFTER_STR(\"SAMLResponse=\").LENGTH.GT(0) || HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.AFTER_STR(\"SAMLResponse=\").BEFORE_STR(\"&\").B64DECODE.REGEX_MATCH(re#(?is)PrefixList.(\"([^\" ]* ){15}|\'([^\' ]* ){15})#))" DROP DROP Note: Please dont copy paste command directly to NS CLI. 2. Batch the command on NS CLI batch -f /var/saml_protection_v1.txt 3. Bind this responder policy to all front End Vserver having SAML SP configuration a. If Front End vserver is Authentication vserver bind authentication vserver <Authentication vserver name> -policy pol_samlauth_prefixlist_block -type AAA_REQUEST -priority 100 b. If Front End vserver is VPN vserver bind vpn vserver <VPN vserver name> -policy pol_samlauth_prefixlist_block -type AAA_REQUEST -priority 100