I'm working with a web app which calling IDP (Okta) and should receive a response to another page as SAML assertion.
How do I "catch" the post SAML Assertion and process it in a landing page/web app?
Thanks
Shnetz
You should take a look at libraries like:
https://www.componentsource.com/product/componentspace-saml2-component
or
https://github.com/KentorIT/authservices
which will help you SAML enable your app. They will take care of handling the SAML logic as a service provider for your app.
Related
I have a requirement where in we have integrated our ECM software with okta. To upload documents to the ECM software, i would need to get the SAML token from okta and append the token with the document upload request webservice.
I would like to know if there are any documentations/ java code snippets which explain a simple okta-saml based authentication without any Spring security or other frameworks.
The reason I am asking this is because, we use a webservice to uplaod the documenst to ECM software wits the SAMl token embedded.
Please let me know how to achieve a simple okta SAML authentication for the above scenario.
Thanks,
Pradeep
I have used some git hub codes without any success.
Of course you can implement a SAMLv2 compliant Service Provider yourself, but this will take some time. I would not only consume the SAML Assertion (the XML Document) as such. The SAML message handling could be done with OpenSAML library (https://wiki.shibboleth.net/confluence/display/OS30/Home), but it won't provide you with a SAMLv2 compliant SP implementation.
We have a Web App using REST API. The REST API is based on Loopback and uses it's built-in token-based authentication. For the Web App we use forms based authentication over HTTPS, so the user has to enter his username and password which we then use to get access token from the REST API via POST /users/login endpoint.
One of our customers asked us to support single sign-on (SSO) authentication through SAML 2.0 and AD FS.
We configured our Web App as a service provider (Relying Party in AD FS) and managed to support SSO for it. The changeling part is the authentication between Web App and the REST API. The idea right now is to configure both Web App and the REST API as the same Relying Party and add new POST /users/saml-login endpoint to the REST API, so the Web App can send a SAML response to that end point and get an access token based on the claims specified in the SAML response. Everything else should work as it used to work before. Here is the flow I imagine:
Web App generates SAML request and redirects a user to the IdP login page
After a successful login the user is redirected back to the Web App with the SAML Response
Web App acts as a proxy and redirects the SAML Response to the REST API endpoint (POST /users/saml-login) where it is validated
If the SAML response is valid the API returns an access token based on the claims
Web App uses access token for further communication with the REST API same as before
Here is the question: Is it OK to implement SAML-based SSO this way? Do you see any issues or security considerations with this approach? Are there any alternatives?
I have read a lot of articles on the web and questions here on StackOverflow about how to use SAML & REST API together:
Propagate SAML Assertion Response/Security Context to downstream Services/Apps
REST API authentication with SAML
SAML and back-end REST service authentication
Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them
None of them really helped me to confirm or reject the idea described above.
That sounds like a reasonable approach. I can't think of any security issues.
You're simply re-posting the SAML response internally within your application for processing. As long as you then perform the various security checks on the SAML response and assertion within your REST API, there shouldn't be any issues.
I've asked this question on Auth0 community but wanted to ask in here also... https://community.auth0.com/t/how-can-i-add-auth0-as-idp-into-adfs/16868
I want to use Auth0 as an IdP for my application. So here is the flow:
Web Application --> ADFS --> Auth0 --> Social
I’ve red this link and did whatever it says; in order to add Auth0 as a Claims Provider into ADFS I’ve used the SAML Metadata URL. As a result I can now select Auth0 as IdP (or CP in ADFS terms) on ADFS login page and it redirects user to log in on Auth0. And client can authenticate on Auth0 with no doubt. But, when ADFS receives the HTTP POST SAML response from Auth0 it throws an error “MSIS0050: SAML Response does not match SAML request.”. And thus, client cannot login to web app.
Here are the details of the exception:
Encountered error during federation passive request.
Additional Data
Protocol Name:
Saml
Relying Party:
Exception details:
Microsoft.IdentityServer.Web.UnsupportedSamlResponseException: MSIS0050: SAML Response does not match SAML request. Request ID: id-2252c816-02de-423c-b518-703cbfd26055, response InResponseTo:
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetSecurityTokenFromSignInResponse(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
So, What can be the problem here? Can you please help me on this?
My fault. For ADFS integration, on Auth0, selection of SAML2 integration medium was a bad idea. I just selected ADFS and it's working now. Thank you.
Our company maintains a Web App composed of a front-end and a back-end in (Node.js), and we support the standard username/password login authentication. A couple of our partners have requested we support SAML SSO, so their end-users can access our web app through a link on their respective portals without the need to login again.
Question: Do we need to turn our app into a full-fledged service provider (SP) by implementing a SAML sdk/library in our front-end and back-end?
Or is it possible to use a 3rd party authentication provider like Okta to handle the SAML nitty-gritty behind the scenes and then redirect the end user to our app, with possibly a token (JWT?) so we can retrieve the user info from Okta?
I've read everything I could find on Okta's site, and here, and couldn't find a definitive answer, either yes it's possible (with example) or no you can't do that.
Like you already mentioned in your question, there are 2 possible ways to do it.
Update your application to support SAML login flow with your app as SP, in which case you will not need to use any 3rd party auth provider
If you don't want to get into the SAML nitty-gritty, you can use a 3rd party provider like Okta as an intermediary that will consume the SAML responses from the IdP (used by your external customers) and then convert that assertion into an Open ID token (JWT). In this case, Okta will act as an IdP (Authorization server) to your web app and generate ID tokens.
Your app will then need to implement the Open ID connect login flow.
You can refer to http://developer.okta.com/code/javascript/okta_sign-in_widget_ref for this.
Im a newbie to the SSO concept and SAML.My requirement is in detail below :
having a common login page. End user will be logged in using credentials;
once the user is logged in, he will be redirected to my application. From there, we will have links to other application.
Here, my application is working as Service Provider.
My question is : as SP, how could I generate SAML 2.0 request to other applications from mine?
How to check whether my application supports SAML 2.0?(its java based).
To conclude, how to generate and send/receive digital signatures through SAML 2.0?
Can anyone please explain me the flow first then direct me to some link?
Does your application support SSO? If not, it probably doesn't support SAML.
You need a client side SAML stack. - examples here.
The commercial implementations in particular have lots of example code.
For Java, look at the Spring SAML extension.
Also, get as much information as you can re. the IDP because that will determine what SAML protocols and bindings you need to implement.