Wanted to use Okta to log in to our application, so we did it using SSO integration. If using Godaddy Cloud, it works great, however if using Google Cloud, we see a white label error page. The Google Cloud is where we actually want to access it. Please provide advice on what to do in this case.
Considering the limited details provided, I presume that Okta is being used for SAML SSO to G-Cloud. If that is the case, then review this reference link: https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Google-Cloud-Platform.html
Usually, the most common reason for a blank page post-authentication is SAML response is not fully consumed by the SP(GCloud in this case).
Related
I have successfully set up my own application with Google SAML, but now I can't understand how do I implement SSO with Google as my IdP.
For example, according to the SAML standart, I (the service provider) should be able to send to Google IdP a logout request to logout a certain user from my system, but I can't find any info about this in google docs.
Similar thing about implementing true SSO in case I will have multiple web services, and I would want to make SSO between them - I can't find any info about that on Google SAML. After Google sends me SAML assertion with user email, that's it, I can't interact with Google, I can't create SSO between my multiple web servers.
So, does Google SAML support SSO? Because it seems to me that the only thing it does is send SAML assertion to my callback URL and that's it.
For example, according to the SAML standart, I (the service provider) should be able to send to Google IdP a logout request to logout a certain user from my system, but I can't find any info about this in google docs.
Google doesn't support SLO, the problem is that this fact is not officially documented, the information can only be found by third parties
Regarding to this question:
I have successfully set up my own application with Google SAML, but now I can't understand how do I implement SSO with Google as my IdP.
I'm not sure if I'm grasping the situation correctly, but I understand that you need your users created on Google to access other configured apps through SSO. In theory (based on my understanding of your question), this federation should be configured within the Admin console as a 'custom app' just like you did it following these steps
Could you elaborate a bit more about what's the behavior you are expecting?
References
Keeper's documentation SAML setup with Google as IdP
I have a service (SP) using Okta SAML SSO. I want to expose multiple landing pages of my service as separate tiles in Okta for IdP-initiated login. Can I create multiple tiles pointing to the same SP application, but with different default RelayStates? Is this a reasonable approach? Will it work with other IDPs?
No, it won't be possible, b/c for each of the applications created in Okta you will have a separate set of IdP metadata, which you won't be able to configure on SP side.
UPDATE: Actually after posting the answer, I double checked, that it MAYBE possible if you create all those applications through API:
they need to have the same IdpIssuer
after creating all of them you need to clone a certificate from one application to all Okta App API reference
I have not tried this approach by myself, but you may give it a try
We want to use SSO for a group of apps (this will include GitLab, probably Drupal and a bunch of small apps I will write in Symfony for various tasks). We would like to currently use Google accounts to authenticate all apps, but because there are limits (I know you can increase them) on how many apps you can have and Google sometimes change what features are free, it would be good to have the option of using our own login down the track if needed.
I have used SimpleSAMLphp in the past with GitLab (using a database to store credentials) and it worked well. Is there a way that I can use the Google Auth as an IDP and have SimpleSAMLphp record the email address to link the accounts etc and allow me to add things like groups etc in to send down to the app when a login happens? I would put a password field in the login table in the database as well so that if we decide to move away from Google we can generate random passwords and continue without too many issues.
The information I find online is for using SimpleSAMLphp as the IDP for gsuite etc (we will be using general Google accounts, not ones in gsuite) and not the other way around. I also couldn't see any Authentication Modules for Google authentication. Are there any tutorials or instructions anywhere on this?
You can accomplish what you are asking fairly easily. Instead of integrating your SPs with Google directly, integrate them with an SSP idP you control, then set up your authentication page (i.e. the page redirected to by your authsource module) to be an SP for Google. Here's what that looks like:
vendor sp -> your SSP idP -> your login app -> your SSP SP -> google idP
This way you end up with only a single Google integration configured for all your vendor integrations. There are numerous benefits to this approach:
You aren't affected by # of integration constraints imposed by google
Since your vendor SP integrations are controlled on your own server, you can easily move to a different cloud-based idP for authentication in the future without having to re-integrate all your SPs
You can easily give your users alternate sign-in choices if you want.
You aren't constrained to SAML or protocols supported by Google. Many vendors still use proprietary token based authentication. These can easily be supported with this setup.
Happy to help with implementation details if you need it.
I am implementing Single Sign On through SAML. For this, I need an IDP (Identity Provider) which can be installed on-premise. Can you provide me the list of IDP's available and their licence Cost and supported platform? I searched and found like Gluu, Shibboleth but not finding the exact. Please help me out.
Thanks in Advance.
Refer SAML-based products and services.
I have used shibboleth and simpleSAMLphp - both open source - both work.
If you want to pay, then Ping Federate, ADFS, OpenAM and Auth0 are all good options.
I do not want to share our user identity with anyone else. We are using Progress Open Edge Database to store user id and password and authenticate from there.
Is there any way that we install IDP on-premise where our user identities should not be shared in cloud rather it is in our network?
I am using OneLogin but it allows to share user id with themseleves but i do not want to share user id with any IDP, instead it should be on my network, that is why i am lokking for an IDP which can be installed on-premise.
A little old post but maybe someone else looking for an answer can benefit. There are many Identity Providers available out there. It depends on your use case which one you should go with and if you need an open source or if you want full support for it.
If your use case requires you to support all the IAM features with easy to configure UI then Keycloak and miniOrange are the ones I would recommend. Keycloak is open source and miniOrange charges for support if you need it. There are others like Shibboleth and SimpleSAMLphp but they don't have an intuitive and easy to use UI and you will have make changes in their config files directly.
As you already pointed above since you don't have any cost issues then you can check out ADFS and Ping Federate.
My best choices will be:
Paid : PingIdentity
Free (as in community) : WSO2 IS, Forgerock OpenAM, Redhat Keycloak
Free : SAMLphp, ADFS (you paid for the servers anyway)
We're a small-ish educational institution whose school email is through Google Apps for Education. We have contracted with an external vendor who is provisioning accounts for Google by getting a list of students from our AD who do not have an email account already provisioned. Once provisioned, the student authenticates to Google services by using their AD account credentials (which is how they access network resources while on campus).
I've been looking into saving a bit of $$ by bringing this process in-house but have been struggling while seeking tangible examples of how to go about doing this. The documentation that I did find has a deprecation warning. Is SAML still how this authentication scheme would be handled? If so, can someone help point me in the correct direction for this?
I've looked through the similar questions and none of them really seem to help.
Python and .NET are accepted solution implementations here.
There are two ways for SSO authentication.
SP-initiated
IDP-initiated
For SP-initiated on google apps you need to:
* Created a certificate and a private key using openssl toolkit or any other tool.
* Upload this certificate to the Google Apps single sign on settings.
* Give login URL to your application etc.
After saving setting on google are done. Now you need to write a code that wil accept request token from google and after parsing send it back to google app.
For code on your side you will use openSAML libraries.
You will also need a keystore(*.jks) in order to make SAML response signed.
These links will help you.
SAML token help.
See this answer.