3

I'm required to integrate my website with SAML authentication, so that any login done to my website, the credentials will be validated by a specific idp (known in advance)

Even after reading many articles about it, Incl. the official technical documentation, I have many open questions:

  1. Can it be automated? i.e, my website is the SP, and I know what IDP I need to authenticate against, can I somehow leave my site as it is, and use the already entered credentials and authenticate them infront of the IDP? Somehow do the authentication myself in the backend, instead of redirecting the user? Is it somehow resembles ECP (Enhanced Proxy)? Is it different mechanism between shibboleth, Okta or do they all follow the same protocol and behavior?

  2. Are all IDP supported servers the same? Or can one decide any authenticaion method he likes to use?

  3. Assuming #1 is possible, How can I authenticate that the response I got is indeed from who it claims it is (avoid MITM)?
Improve this question
2
  • Exactly what are the requirements? Strange just to have to "integrate SAML". I would be expect to have to meet specific SSO requirements. – Neil Smithline Mar 6 '16 at 20:19
  • @NeilSmithline The requirements are to make my site act as a service provider for a company and make it able to login to it with existing users in their IDP. So I would need to be able to do two things: login through browser - using regular redirects profile, but also delegate the entire login process to my backend, as I have services there that requires authenticaitng the user. Is it possible to do that delegation? Would it be generic or require fitting it to each and every different IDP as they may have different authentication ways? – buddy123 Mar 7 '16 at 7:12
1

Some partial answers:

1.1. When you know (from what kind of information? Do you only accept one IDP for all users?) which IDP to use, use it. You can than skip the indirection via DiskoJuice or another IDP choser.

1.2. Doing the authentication yourself defies the purpose of using SAML. You can do Basic authentication via https instead.

  1. Not necessarily. Each IDP can chose whatever sorftware they want to use. Only the protocol is fixed.

  2. With SAML you only know that the user trying to log in know his credentials (username and password). Use secure connections (https only, don't allow http) to avoid leaking of the credentials and MITM attacks.

EDIT: When you really want to understand SAML, look at the PhD thesis of Thomas Gross here: http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf

It contains an in-depth analysis of SAML with rigorous proofs (and counter-examples for SAML 1.0) of security features.

Improve this answer
4
  • I want to delegate the auth process to my server-side, I thought ECP providing it somehow (yet couldn't really understand it all the way through). So with SAML all I do is redirect to the known IDP (i.e using POST profile) with a known token, and then wait for it to post back the saml response and check it's status, and then by using the token redirect it back to where it wanted to go from the first place? and for extra assurance the only way to validate the response is indeed OK is using https channel? because I read there's a secured saml but there's not much docs about it – buddy123 Mar 6 '16 at 13:42
  • @buddy123: When you are looking for a good reference, see the EDIT of my answer. – jk - Reinstate Monica Mar 7 '16 at 8:35
  • Thanks, I looked into it but didnt find talk about ECP, Can it somehow allow me to delegate the auth to my backend doing it myself, without user interaction? – buddy123 Mar 7 '16 at 11:00
  • I don't recommend using Salesforce's delegated auth function, and, as such, I sure wouldn't trust you to properly care for my authn credentials. I'm paranoid that way. What do you need the credentials of the user for? Ultimately, it may take some refactoring to be done on your site, but if you want to get into this SP role for other companies, it may make sense. – Andrew K. Mar 7 '16 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.