We have Single Sign-On (SSO) done via SAML.
Currently we have requirement to sync users from ADFS to our database as well as ADFS groups.
I was able to google out solutions for LDAP, however that seems quite old.
Is it possible to do this via SAML? Any other method?
I would be using PHP.
Both SAML and ADFS are about authentication.
What you are referring to is provisioning which is not provided by either.
The modern standard for provisioning is SCIM.
Related
We've developed a SAML2 SP (supporting IdP-Initiated SSO, as per the user journey we want).
My question is, short of developing an IdP, how can we test it is working? Is there an IdP-Initiated SSO test harness out there? (I know of SSO Circle, but that is for SP-Initiated SSO).
You can use a trial account from Onelogin and configure a SAML Test Connector, or deploy your own IdP with simpleSAMLphp
You can test out IdP-Initiated SSO via this JS Bin: https://output.jsbin.com/nukiso
The code is quite long and wouldn't be appropriate to put directly into this post.
It works completely on the browser side and uses web crypto APIs for signing the assertion. It is probably a better idea to use a real IdP as this is more of a tool for learning how to make the SAML response/assertion. To prevent anyone from being able to log into your website without authentication, do not use the JS Bin IdP metadata on a public/production server.
I am reading alot about federated identity management and technologies like SAML, which can be used for implementing SSO for web applications, and Kerberos, which can be used for implementing SSO für desktop applications.
This is how I understood it so far. If we have the case, that we want to have SSO for a set of web applications and desktop applications, what are the technologies that are available for that? Do I have to combine SAML and Kerberos or is there another technology that fits better?
AFAIK, Microsoft ADFS and Oracle Access Manager are SSO products which supports SAML, Kerberos and other related protocols, does Windows based authentication and thus provide SSO access across webapps and desktop.
Check,
http://blogs.technet.com/b/abizerh/archive/2013/04/11/more-information-about-sso-experience-when-authenticating-via-adfs.aspx
https://docs.oracle.com/cd/E29542_01/doc.1111/e15740/wna.htm
We have a requirement where user needs to login to portal with CAS (but SAML way). User can also login via login portlet of liferay.
We have few apps hosted on Intranet and few on Extranet. When user is in our office network, he should be able to login to all the apps via SSO. This includes apps which are hosted on extranet as well.
To achive this we want to use SAML with CAS.
By doing some research I understand that in this case CAS would be my IDP i.e. Identity provider and my apps on extranet would be SP i.e. service provider
Any idea how to proceed with it?
Any help is appreciated.
I have to do the same thing but using a LDAP too ...
I'm following this cookbook to achieve that, the second chapter talks about Authentication and Registration Process
I hope this would be helpful!!
We are looking forward to implement ADFS to implement SSO across our organization for various set of web applications such as (SAP, Siebel, Custom java based, Asp.net etc.).
I understand based on my research that ADFS can be used to achieve SSO for third party applications using SAML. It can act as an identity provider for third party applications. Please correct me if I am wrong.
Can we use the ADFS to implement cookie based SSO for the various internal web based apps which I mentioned above?? (For Ex: CA Siteminder, ORacle Access manager can work with almost every internal web based application)
In other words: we have one application using apache webserver, one using IIS webserver, one using IHS webserver; can ADFS be used to achieve Single sign on with all these applications??? If yes, How ???
Thanks in Advance...!!
Ashish
ADFS implements SSO via federation using either WS-Fed or SAML 2.0.
If these applications can support these protocols, then yes just federate these products with ADFS and you will get SSO.
e.g. SalesForce SSO with ADFS.
For Java you need a SAML stack e.g. Spring Security.
For ASP.NET, use OWIN or WIF.
My company is using shibboleth to perform Single sign on.
The applications we use to sign in are wordpress and Owncloud. Now, We are planning to include Tuleap Open ALM (Application Lifecycle Management) to use shibboleth to do single sign on.
So is there a plug-in to do it, A way it can be done or is it possible or impossible, Could you provide your views and thoughts to help me?
There is no explicit plugin for Tuleap to use shibboleth. However, I think shibboleth can be used with openId and that Tuleap can also be configured to use openId. The other Tuleap authentication methods are native and ldap.