5 ms·
Would this imply end user having to have a SAML server on the public internet? I'd guess big companies would be wary about this
by sitepodmatt 8y ago
Would this imply end user having to have a SAML server on the public internet? I'd guess big companies would be wary about this
- icebraining 8y agoIn our case, it was the opposite: the SaaS (for that client) was not on the public Internet. The client reserved some machines on their DC and we set up a private installation there.
- jcims 8y agoNot necessarily. Both the customer-side component (IdP) and SaaS-side component (SP) just have to be reachable by the client. If the customer org has its clients on a private network, SAML can function just fine without being accessible from the Internet. Just put the IdP on the private network and the SaaS can run anywhere the client can reach. Look up SAML ‘profiles’ to see the flows. There are exceptions to the above but they are rarely required.
- tonyarkles 8y agoI'm just in the process of setting that up right now! We're on the SP side, and the IdP lives inside an enterprise network and is not externally accessible. The only problem is that it's a bit tricky to debug, since they won't give us VPN access at all. Debugging involves picking up the phone, asking our contact to do a login, and watching the log messages. Slow, but it works and it's a big enough contract that it's clearly worth it.