4 ms·

Unfortunately every enterprise-level SAML server implementation has critical incompatibilities with the others. So you need to support specific servers and that

Unfortunately every enterprise-level SAML server implementation has critical incompatibilities with the others. So you need to support specific servers and that's a lot of work and testing.

amelius 8y ago
Isn't there some (e.g. NodeJS) library for that?
vertex-four 8y ago
Surely, in practice, you support ADFS and Shibboleth, and then you implement additional support as your clients ask it of you. If you're doing it the Microsoft way, you throw up your own instance of ADFS, configure that to authenticate against your clients' SAML IDPs, and authenticate against your own ADFS yourself, thus avoiding having to deal with interop concerns within your own application. Practically everybody can interop with ADFS. On non-Microsoft systems, I believe the likes of OpenAM (or its paid-for version, ForgeRock Access Management) can do this, among other options.
orev 8y ago
I have integrated as an SP with a number of different IdPs and have yet to run into any problems. For the number of players in the space, it’s remarkably compatible.
- zrail 8y ago
  Same (author of the OP here). Every IdP is slightly different, but at this point adding a new one is just importing their certificate and checking the right boxes (GET/POST, IdP vs SP initiation, etc).
  - derptron 8y ago
    Until your organization makes you jump though hoops to get their cert.