I know UAA supports using OAuth to SSO into downstream applications. Has anyone tried to make UAA a SAML IDP - issuing SAML assertions to downstream SAML SP's?
It is a feature that is underway.
I believe it will show up no later than Q2/2016, possibly earlier
Related
We are acting as service provider (supporting SAML2.0) and we are working on a proposal to federate with a new federation whose IDP is ADFS2.0. We are currently supporting several other Federations that are currently using OKTA as their IDP.
We expect the IDP to post SAML assertion either through (SP initiated or IDP initiated). If ADFS2.0 is acting as IDP, will the SAML assertion will be similar to OKTA or will it be different? (I heard that the SAML assertion from ADFS2.0 will be compressed in addition to Base64 encoding while from OKTA it is only base64 encoded.)
You can expect both OKTA and ADFS to support the SAML2 standard.
If you are using the HTTP Redirect binding the xml is deflated+Base64-encoded. If you are using the HTTP POST binding the xml is only Base64-encoded. For receiving SAML2 assertions you shouldn't use the HTTP Redirect binding due to data length restrictions. So if you have a working implementation for OKTA it should work for ADFS too.
I am creating a java application to implement SSO (SAML) using ADFS. I am not sure if SAML can be done using ADFS alone. While installing ADFS, I noticed that it required configurations of relying party and claim providers trusts (which are basically the SP and IP, right?). I am confused as to whether to have SP and IP in the java application, or just leave it to the ADFS to handle.
Any help would be greatly appreciated. Thanks!
Your Java application needs a SAML stack and becomes the SP.
Refer: SAML : SAML connectivity / toolkit for some ideas if you don't have one.
ADFS (which handles SAML 2.0) can then function as the IDP.
You will also have to configure the claims in ADFS - which correspond to the SAML assertions.
Your Java application will be a Service Provider (SP) that receives identity from an Identity Provider (IdP) server. In the use case you have outlined, ADFS will be the IdP Server. within your application you will need to integrate a library (e.g. SAML stack) to process the SAML assertion. SAML requires configuration on both sides of the interface. There are a few open source options such as OpenSAML. Depending on your organization, you may want to look at a vendor provided solution as well for long term support.
Does Thinktecture IdentityServer V3 has support for SAML or does it only support OAuth?
IdentityServer v3 supports any Katana-compatible Owin middleware for authentication. With a compatible middleware for SAML2 such as Kentor.AuthServices IdentityServer 3 can authenticate against external SAML2 Identity Providers with Idsrv acting as a SAML2 Service Provider. I wrote a blog post on how to do it.
There's also a plugin interface which would allow IdentityServer v3 to act as a SAML2 Identity Provider but as far as I know there's no implementation available.
There is Owin middleware to support the SAML protocol you can use with IdentityServer v3. It does not yet support all flows but it is being used in a couple implementations. Full disclosure - I am the author of this code which was forked from a previous SAML2 library on CodePlex.
OpenID Connect, OAuth2, WS-Fed.
#DavidEdwards - no - IdentityServer2 has no SAML support OOTB.
I normally get around this by:
IdentityServer --> WS-Fed --> ADFS --> SAML --> IDP
Nope! No SAML.
leastPrivilege.com
In the article Dominick says... "Having spent a considerable amount of time in the WS*/SAML world, it became more and more apparent that these technologies are not a good match for the modern types of applications that we (and our customers) like to build."
They focused on OpenID Connect and OAuth2.
I am very confused about my current ADFS setup. I have an identity provider that issues a SAML 2.0 token to ADFS 2.0 in an IDP-Initiated scenario. ADFS translates the token into WS-Federation, and forwards it on to a claims aware (WIF) web application. The web application, however doesn't recognize the user has having authenticated and redirects back to Home Realm discovery. I've used SAML Tracer in Firefox and I can see the SAML assertions going in and the WS-Federation claims in the parameters being sent to the web application. Is there a step I am missing? I set up custom claim rules to translate the SAML assertion into a WS-Federation claim (e.g. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name) If I switch the SP application to a SAML 2 web app, then everything works fine.
So after comparing the headers of an IDP initiated request and an SP initiated request, I noticed a difference. The IDP initiated request was missing the wctx parameter. Once I included this in my relaystate, the WIF RP app worked fine.
wctx=rm%3D0%26id%3Dpassive%26ru%3D%252FMyDesiredStartPage.aspx
I am getting a strange error from ADFS 2.0 event Log as follows:
"The Federation Service could not fulfill the token-issuance request because the relying party 'https://my-relying-party' is missing a WS-Federation Passive endpoint address.
Relying party: https://my-relying-party
This request failed.
User Action
Use the AD FS 2.0 Management snap-in to configure a WS-Federation Passive endpoint on this relying party."
This happens after SAML response is verified successfully by ADFS 2.0 but apparently fails to issue a token for the relying party application.
I configured in ADFS 2.0 both IDP and SP as SAML 2.0 so I don't understand why is WS-Federation endpoint is expected?
Any help will be appreciated.
Is your web application talking the WS-Federation protocol or the SAML protocol (SAML-P)? If your web application is based on WIF, then you are using WS-Federation. Note that both protocols use SAML tokens.
If your application talks the WS-Federation protocol, then in your AD FS Relying Party Trust you need to set the WS-Federation endpoint(s). If it talks the SAML protocol, you need to set the SAML protocol endpoint(s).
Based on your error message, your application probably talks WS-Federation, therefore you need to set the WS-Federation endpoint.
The integration between your SAML 2.0 SP (ADFSv2) and your RP Application is done via WS-Federation Passive Requester Profile. So you'll need to setup your application to receive the WS-Fed Response and parse it appropriately. You'll also have to configure ADFSv2 to generate this message as well (per the error message you received).
Hope this helps -
Ian
You need to add the web application url to the endpoints in the properties of you relying party.
add ws-federation passive reference manually or in federation file will solve the problem.
Please let me know if you need detail guidance.