5 ms·

I was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it'

by jtl999 8y ago

I was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into) Even storing my custom hashes in LDAP would have been acceptable.

hb3b 8y ago
Shibboleth, simplesamlphp. Both offer easy ways to add custom login handlers.
- xenophonf 8y ago
  Shibboleth is _the_ gold standard when it comes to SAML. I'm at the point where I don't recommend anything else, and I'm willing to help people deploy it (contact info in profile). For this use case, they'd also need to configure JAAS.
  - jtl999 8y ago
    I'll give just Shibboleth a try later. I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
    - Freak_NL 8y ago
      > but I'm no expert cryptographer either. You don't have to be, as you would not implement any cryptographic algorithms (ciphers, hash methods) yourself. Solid experience with software security in general is a requirement of course.
    - user5994461 8y ago
      Not to be dismissive but better look for an alternative solution. The SAML spec is a beast, you can work on it for months, you will hardly get a few percents of it working. If you're doing that for a small company, maybe try to get a Microsoft active directory instead. It's a lot easier to setup and maintain and everything does their best to integrate with it.
      - xenophonf 8y ago
        I realize it's a little late to say this, but AD FS is garbage. I've run AD FS both as an InCommon IdP and an InCommon SP, with both as full federation partners. While I solved the metadata consumption, attribute scope checking, and discovery UX issues, I encountered lots of little interoperability issues that required disabling request/assertion encryption or switching between SHA-1/SHA-256 on individual CP/RP trusts. Ultimately, we replaced the IdPs with Shibboleth and moved the SPs behind SATOSA, which works a LOT better.
    - xenophonf 8y ago
      I'll join the chorus recommending against inventing the wheel, unless you're doing that to learn SAML in which case I say more power to you. You should look into the existing work done by Roland Hedberg, SUNET, and others on pysaml2, which is now part of the IdentityPython project: https://idpy.org/ https://idpy.org/ https://github.com/IdentityPython https://github.com/IdentityPython That said, I can't think of anyone using pysaml2 to implement identity providers aside from SATOSA, an IdP proxy. Nearly everyone I know runs either Shibboleth or SimpleSAMLphp. I recommend you run Shibboleth because there's a whole litany of interoperability issues you _won't_ encounter if you do. (The same goes for SimpleSAMLphp, but I have less experience with it.) The IdentityPython and Shibboleth projects have a lot of overlap in terms of membership, and if you want to meet them and connect to the research and education side of the federated IdM community, which drives a lot of the open source work, you should come to the Internet2 Technology Exchange this year and stay for ACAMP. It's a super smart bunch of people. You'll learn a lot.
tiny-dancer 8y ago
Keycloak is a personal fave for this general space https://github.com/keycloak/keycloak https://github.com/keycloak/keycloak
- thomasfedb 8y ago
  Had a good look into this, also quite a complicated solution. I've been looking for a good solution to the "I have 3 small web apps that are used by the same people, I should centralise authentication and authorization" problem, and yet to find something sensible for that usecase.
  - madspindel 8y ago
    Why not use Azure AD B2C or Firebase Authentication?
  - willow9886 8y ago
    Why not a cloud provider like Google Identity, Okta, OneLogin, etc?
user5994461 8y ago
The product is OpenAM from Forgerock, that is both open source and expensive. https://www.forgerock.com/ https://www.forgerock.com/ Gluu is just a facade company that's recompiling it from source and distributing the binaries for free. It supports pretty much everything you can dream of, including different password hashing and you can write your own plugins to interface with anything you like. However it's a very complicated product. It's for a large company or a country with a dedicated team to run and customize. P.S. Not affiliated to any of these companies. I had to do the performance assessment of these products some year ago for a government contract. https://thehftguy.com/2015/10/14/iam-benchmarks-openam-vs-wshttpso2-vs-simplesamlphp-vs-shibboleth-2/ https://thehftguy.com/2015/10/14/iam-benchmarks-openam-vs-ws...
- jsiepkes 8y ago
  Gluu isn't based on OpenAM. Gluu is based on a whole bunch of other products (like Shibboleth) but not OpenAM. OpenAM originated from Sun's OpenSSO when Oracle bought Sun and FrogeRock was created. Incidentally this is the same time Gluu was created. OpenAM is also no longer opensource. The source was closed by Forgerock in the beginning of 2018. One of the forks that sprung from this source closing is wren:security ( https://wrensecurity.org https://wrensecurity.org ). Disclosure: I work on that project ;-)
  - user5994461 8y ago
    Good to know. Gluu was built upon and dependent on ForgeRock products last I was working with it. I guess they're having a pretty bad time if ForgeRock pulled the sources.
    - willow9886 8y ago
      The Gluu Server bundles a fork of OpenDJ 3.0 for persistence, the last open source build. It also supports OpenLDAP, and will soon support Couchbase.
- willow9886 8y ago
  Gluu writes its own software, like the OAuth2 Authorization Server, oxAuth, and bundles other open source software like the Shibboleth SAML IDP.

by jtl999 8y ago

hb3b 8y ago

Shibboleth, simplesamlphp. Both offer easy ways to add custom login handlers.

xenophonf 8y ago
Shibboleth is _the_ gold standard when it comes to SAML. I'm at the point where I don't recommend anything else, and I'm willing to help people deploy it (contact info in profile). For this use case, they'd also need to configure JAAS.
- jtl999 8y ago
  I'll give just Shibboleth a try later. I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
  - Freak_NL 8y ago
    > but I'm no expert cryptographer either. You don't have to be, as you would not implement any cryptographic algorithms (ciphers, hash methods) yourself. Solid experience with software security in general is a requirement of course.
  - user5994461 8y ago
    Not to be dismissive but better look for an alternative solution. The SAML spec is a beast, you can work on it for months, you will hardly get a few percents of it working. If you're doing that for a small company, maybe try to get a Microsoft active directory instead. It's a lot easier to setup and maintain and everything does their best to integrate with it.
    - xenophonf 8y ago
      I realize it's a little late to say this, but AD FS is garbage. I've run AD FS both as an InCommon IdP and an InCommon SP, with both as full federation partners. While I solved the metadata consumption, attribute scope checking, and discovery UX issues, I encountered lots of little interoperability issues that required disabling request/assertion encryption or switching between SHA-1/SHA-256 on individual CP/RP trusts. Ultimately, we replaced the IdPs with Shibboleth and moved the SPs behind SATOSA, which works a LOT better.
  - xenophonf 8y ago
    I'll join the chorus recommending against inventing the wheel, unless you're doing that to learn SAML in which case I say more power to you. You should look into the existing work done by Roland Hedberg, SUNET, and others on pysaml2, which is now part of the IdentityPython project: https://idpy.org/ https://idpy.org/ https://github.com/IdentityPython https://github.com/IdentityPython That said, I can't think of anyone using pysaml2 to implement identity providers aside from SATOSA, an IdP proxy. Nearly everyone I know runs either Shibboleth or SimpleSAMLphp. I recommend you run Shibboleth because there's a whole litany of interoperability issues you _won't_ encounter if you do. (The same goes for SimpleSAMLphp, but I have less experience with it.) The IdentityPython and Shibboleth projects have a lot of overlap in terms of membership, and if you want to meet them and connect to the research and education side of the federated IdM community, which drives a lot of the open source work, you should come to the Internet2 Technology Exchange this year and stay for ACAMP. It's a super smart bunch of people. You'll learn a lot.

tiny-dancer 8y ago

Keycloak is a personal fave for this general space https://github.com/keycloak/keycloak https://github.com/keycloak/keycloak

thomasfedb 8y ago
Had a good look into this, also quite a complicated solution. I've been looking for a good solution to the "I have 3 small web apps that are used by the same people, I should centralise authentication and authorization" problem, and yet to find something sensible for that usecase.
- madspindel 8y ago
  Why not use Azure AD B2C or Firebase Authentication?
- willow9886 8y ago
  Why not a cloud provider like Google Identity, Okta, OneLogin, etc?

user5994461 8y ago

The product is OpenAM from Forgerock, that is both open source and expensive. https://www.forgerock.com/ https://www.forgerock.com/ Gluu is just a facade company that's recompiling it from source and distributing the binaries for free. It supports pretty much everything you can dream of, including different password hashing and you can write your own plugins to interface with anything you like. However it's a very complicated product. It's for a large company or a country with a dedicated team to run and customize. P.S. Not affiliated to any of these companies. I had to do the performance assessment of these products some year ago for a government contract. https://thehftguy.com/2015/10/14/iam-benchmarks-openam-vs-wshttpso2-vs-simplesamlphp-vs-shibboleth-2/ https://thehftguy.com/2015/10/14/iam-benchmarks-openam-vs-ws...

jsiepkes 8y ago
Gluu isn't based on OpenAM. Gluu is based on a whole bunch of other products (like Shibboleth) but not OpenAM. OpenAM originated from Sun's OpenSSO when Oracle bought Sun and FrogeRock was created. Incidentally this is the same time Gluu was created. OpenAM is also no longer opensource. The source was closed by Forgerock in the beginning of 2018. One of the forks that sprung from this source closing is wren:security ( https://wrensecurity.org https://wrensecurity.org ). Disclosure: I work on that project ;-)
- user5994461 8y ago
  Good to know. Gluu was built upon and dependent on ForgeRock products last I was working with it. I guess they're having a pretty bad time if ForgeRock pulled the sources.
  - willow9886 8y ago
    The Gluu Server bundles a fork of OpenDJ 3.0 for persistence, the last open source build. It also supports OpenLDAP, and will soon support Couchbase.
willow9886 8y ago
Gluu writes its own software, like the OAuth2 Authorization Server, oxAuth, and bundles other open source software like the Shibboleth SAML IDP.