I'm developing a number of RESTful API's and they are consumed by another web applications.
What is the most secure protocol (SAML2 or oAuth2) for use in this scenario ?
What is the best approach to secure RESTful web services using WSO2
Identity Server ?
First differentiate OAuth and SAML, its not about what is more secure but what is most suitable for your scenario. SAML is mainly used if you need to have SSO (Single Sign On), Federation and Identity Management. OAuth is a authorization resource standard [1].
You can simply secure REST APIs by using only WSO2 APIM which has OAuth out of box. You can easily follow APIM Quick Start guide and setup it [2]. If you need to achieve more requirements like SSO and federation, you need to integrate WSO2 IS [3]
[1] https://dzone.com/articles/saml-versus-oauth-which-one
[2] https://docs.wso2.com/display/AM1100/Quick+Start+Guide
[3] https://docs.wso2.com/display/CLUSTER44x/Configuring+the+Identity+Server+5.1.0+as+a+Key+Manager+with+API+Manager+1.10.0
Related
We are in process of building a series of apps that will run offline or in very austere environments. We'll also be integrating with other 3rd party apps. Many of these will require logins so we're attempting to use SAML to handle login between them.
I found saml2-js:
https://github.com/Clever/saml2
And it seemed like a great starting point for both the SAML Service Provider and Identity Provider - but diving in I now see it does not implement the Identity Provider at all.
I already have a basic SAML Service Provider setup, but we need an Identity Provider that can run offline. Are there any Node or GoLang Identity Provider libraries we can use to implement this? If not, another recommendation?
Passport is the usual Node option but that's client side only.
There are a number of IDP's you can use e.g.:
Free: simpleSAMLphp / Shibboleth / identityserver4
Cloud: Auth0 / Okta / Azure AD
On-premises: ADFS
I implemented authentication and authorization using Identity server 4 with OIDC to allow clients accessing our application to get the necessary tokens to access our resource server (web APIs). This is the current architecture :
Identity Server 4 using my custom DB to authenticate users
Resource APIs (ASP.NET Core)
Angular 2 front end
I need to implement SSO, where users from other systems will pass SAML2 assertions from their identity providers to allow them to access our resource APIs without logging in to our application.
I have some confusion about where this step will happen, and what will be the workflow, will our identity server be involved in this process and how to implement that using Identity Server 4.
Right now there is no SAML2 support for ASP.NET Core.
If you are using IdentityServer3, you can act as a SAML2 SP via the Kentor authentication middleware. This is not available for ASP.NET Core yet.
Generally speaking - you cannot use SAML2 to secure APIs - it is a protocol for web based SSO - not API access.
Does Thinktecture IdentityServer V3 has support for SAML or does it only support OAuth?
IdentityServer v3 supports any Katana-compatible Owin middleware for authentication. With a compatible middleware for SAML2 such as Kentor.AuthServices IdentityServer 3 can authenticate against external SAML2 Identity Providers with Idsrv acting as a SAML2 Service Provider. I wrote a blog post on how to do it.
There's also a plugin interface which would allow IdentityServer v3 to act as a SAML2 Identity Provider but as far as I know there's no implementation available.
There is Owin middleware to support the SAML protocol you can use with IdentityServer v3. It does not yet support all flows but it is being used in a couple implementations. Full disclosure - I am the author of this code which was forked from a previous SAML2 library on CodePlex.
OpenID Connect, OAuth2, WS-Fed.
#DavidEdwards - no - IdentityServer2 has no SAML support OOTB.
I normally get around this by:
IdentityServer --> WS-Fed --> ADFS --> SAML --> IDP
Nope! No SAML.
leastPrivilege.com
In the article Dominick says... "Having spent a considerable amount of time in the WS*/SAML world, it became more and more apparent that these technologies are not a good match for the modern types of applications that we (and our customers) like to build."
They focused on OpenID Connect and OAuth2.
I've been dropped into a hot potato project...an external entity produced a SOA architecture and we need to implement it now.
Using Drupal as a CMS and starting point of the architecture.
Here's what I think we need to do:
Authentication server
People register through the drupal site. We'd like to reuse the identity created for other (future) services, through a REST API
a) Can I add users to WSO2 Identity Server via a (REST) API?
b) Can I query WSO2IS to authenticate users via a (REST) API (creating a SSO env)?
c) Can I create re-usable profiles in WSO2IS, accessible through a (REST) API?
d) Can I authenticate drupal access via WSO2IS through a (REST) API?
e) Can I query the XACML policies via a (REST) API so that access to a requested service can be evaluated?
Other REST APIs we're going to build would use the OAuth functionality of WSO2
The architecture mandates each an authentication, a profiles and a policy (authorization) with XACML (...) module. The alternative is to build it all ourselves but I think we won't have the time for this, but I need to understand if we can do the above mentioned things to make a decision if WSO2IS is a good choice for our needs.
I have read the available documentation, browsed the help system, installed WSO2IS and checked out the interfaces, but couldn't find the responses. The only thing I managed to do is create the OAuth server.
Please find my answers..
a) Yes.. WSO2 Identity Server supports SCIM which is the standard approach for identity provisioning. Also there are web service APIs, that expose user management functions. You can front those web service API using WSO2 APIM and can expose as REST API.
b) Yes.. Apart from REST and web service API, Identity Server supports for authentication methods such as SAML2SSO, OpenID, IWA and so on.
c) Yes.. same as a) you have both options SCIM or Web service API fronted with APIM
d) There is an authentication framework in the WSO2IS, that users can be authenticated with different server.. Basically WSO2IS can act as federated IDP that application knows only to talk to WSO2IS.. WSO2IS can authenticate users from any other IDP, It can be drupal as well
e) Yes.. XACML is supported by WSO2IS... Its PDP API has been exposed via web service API.. but not as a REST API.. but as i mentioned earlier, you can expose it as REST using APIM. However REST support for XACML would be available with the further release
I am trying to setup WSO2 cloud identity server (stratoslive) as the identity provider and salesforce as a service provider. Basically in salesforce I want to leverage the salesforce federated single sign on feature and connect with stratoslive identity server. Will be helpful if anyone can give me a link to follow or can guide me with the steps.
I am relatively new to the identity and access domain and for one of my project I need to setup WSO2 startoslive as identity provider and salesforce as service provider and have to fit in SAML in this process.
Thanks
Indranil
These links should be helpful to implement your use case:
WSO2 SAML Single Sign-On with Google Apps Tutorial
http://wso2.com/library/articles/integrate-google-apps-wso2-cloud-identity/
WSO2 Identity Server Single Sign-On Documentation
http://docs.wso2.org/display/IS450/Managing+Single+Sign-On
Salesforce SAML Single Sign-On Reference
https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_saml.htm&language=en