26 ms·
I rolled my own at work based on https://github.com/displayr/AspNetSaml https://github.com/displayr/AspNetSaml which I forked from https://github.com/jitbit/Asp
by quickthrower2 7y ago
I rolled my own at work based on https://github.com/displayr/AspNetSaml https://github.com/displayr/AspNetSaml which I forked from https://github.com/jitbit/AspNetSaml https://github.com/jitbit/AspNetSaml
There is a PR to make it work with .NET core at the moment.
Once you understand the protocol it’s a case of storing some fields relating to the IdP in your database, for each tenant. Redirect to the IdP website and they’ll redirect back to you and post a signed XML doc to daub Joe is authenticated and belongs to these groups.
- gtsteve 7y agoI gave this code a quick skim and it seems reasonably well thought out and I wish I'd seen it before I rolled my own at work. There are numerous security flaws that one can accidentally introduce with SAML and it seems you've avoided the obvious ones at the very least (i.e. not checking there's only a single assertion, etc). Just in case you weren't aware of it, I found this page very helpful when developing mine: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...
- quickthrower2 7y agoThanks. I can’t take too much credit: Jitbit did most of that work, I added some integration testing and added a couple of methods.