I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP. I am using "https://simplesamlphp.org/"

For example, I have 3 websites "example.com", "one.example.com", "two.example.com"; All are on three different server. Now, I want to setup single sign on login using SAML then on which server I need to setup IdP. As "example.com" is main domain which has all the information about user.

As I learn, when I login to "example.com" then it sends request to IdP.

But I don't get any idea where I have to set IdP and what Idp contains?. Its on same server where "example.com" hosted OR its different server and what logic I have to write on that server? It's simple login function OR I need to setup "simplesaml" for this and set login logic to there.

After setting up IdP, what I need to do on other server "one.example.com", "two.example.com"? Do I need to install again "simplesaml" to both server and set SP and IdP?

In sort, which server has IdP and SP? And on which server I need to install "simplesaml"?

Thanks in advance

  • I understand that you are learning about SAML, but unless you have a specific need for SAML, I would recommend you to look a OAuth instead as it is much simpler. OAuth can provide the same SSO experience that you are looking for. – Daniel Jul 20 '18 at 6:37

You can compare SAML to OAuth in the following way:

  • SAML IdP (Identity Provider) is an Authorization Server.
  • SAML SP (Service Provider) is a Resource Server.

Your SAML IdP should be running as a stand alone service and you can set it up on a domain name of your choosing e.g. idp.example.com or auth.example.com etc.

On any page where you want to have SSO, you must configure it as a SAML SP and configure it to accept SAML assertions from your IdP. This is typically done by installing a certificate from the IdP in your SP.

When you are going to www.example.com and you click Sign in using SAML, your website should redirect you to the IdP server, where you will enter your credentials (once). Then the IdP will redirect you back to the SP with a signed assertion containing your identity.

The next time you are going to a page and click the sign in button, the IdP will still remember you (depending on configuration).

You seem to be concerned about domain names, and I will try to clarify:

It does not matter to SAML what your domain names are. Your SP can be at xyz.example.net and your IdP can be at abc.example.com. Everything is handled through HTTP redirects.

Just remember that you must use public domain names that you own if you want to use a trusted certificate authority. And you should definitely use HTTPS on all of your sites.

  • I got you comment but my main concern is where to I have install "simplesamlphp". Its only on one site OR all site? – Jaydp Jul 20 '18 at 6:43
  • simplesamlphp acts as an IdP and should be setup once on a separate server. On your individual sites you must setup SAML using a client library (as a server provider) and you may find a library in the respective programming language. For PHP libraries, you can go to packages.org e.g. – Daniel Jul 20 '18 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.