3 ms·
In most cases, SP doesn't know user is removed from IdP. If there's a need for such feature, you resort to shared sessions - IdP has control of storage service
by maxymajzr 7y ago
In most cases, SP doesn't know user is removed from IdP. If there's a need for such feature, you resort to shared sessions - IdP has control of storage service where SP's save sessions (say, Redis). Once user is removed from IdP, IdP deletes the session record in Redis and SP loses all user info.
This implementation happens rarely.
The single logout process is often flawed since it depends on SP's accurately processing the request and returning the user back to IdP if a session has been successfully destroyed. This often fails due to network connectivity, problems with session destroying at the SP, SP's not implementing the SingleLogout properly etc. What I've experienced and seen in many cases is that IdP simply kills the session it has on the user and stops right there, then the rest of the SP's handle it through back-channel.
I work in this area so I'm relaying my experience through past 10 years of implementing SSO for various enterprises.
In reality, the SAML protocol is quite straight-forward but something odd happens when people hear the term SSO. It's not magic, it's quite trivial but takes a bit of discipline to grasp it fully and implement properly.
- recursive 7y ago> it's quite trivial I've been tasked with authenticating in an existing application via SAML 2.0 I've got the whole SAML 2.0 specification printed and sitting on my desk right now. It sure doesn't look trivial.
- deleted 7y ago[deleted]
- CaliforniaKarl 7y agoWhen people say "Don't roll your own encryption" or "Don't implement $ALGORITHM, just use libsodium", I think that also applies to web authentication (be it OAuth or SAML). If you are the 'client' that wants to authenticate an incoming user, then I'd point you to an existing SP like Shibboleth or SimpleSAMLPHP or even CILogon (which bridges SAML and OAuth). If you are handing out authentications, then you are an IdP and I'd point you to something like Shibboleth or ADFS or Okta. It is good to have the relevant RFCs to hand, but I would not make an implementation from scratch, unless there was a very good reason for it.
- recursive 7y agoI'm trying to build an "SP" or "relying party" as I've learned in the jargon of the domain. Building an implementation from scratch is the last thing I want to do. I feel like I'd rather pull out my own teeth. But a difficulty of finding any information about it has lead me to start reading all the official specs as a kind of last resort. In my initial research, I did discover Shibboleth, but was under the impression that it was an IDP only. I will check out the SP component, because I would love to not implement it from scratch. At first glance, I see this: https://www.shibboleth.net/products/service-provider/ https://www.shibboleth.net/products/service-provider/ It basically seems pretty opaque. The downloads at https://shibboleth.net/downloads/service-provider/latest/ https://shibboleth.net/downloads/service-provider/latest/ don't really provide much clue of how to build them or incorporate them into my app, which is written in a different language than any of these source files. I'll keep looking.
- danellis 7y agoIf you're willing to use PHP, there's also "the award-winning" SimpleSAMLphp (https://simplesamlphp.org/ https://simplesamlphp.org/), which can operate as IdP or SP. I can tell you that many big names in the TV Everywhere space are using it.
- labanna 7y agoI was just tasked last week with implementing SAML auth for our applications and have settled on Shibboleth. For the SP I just installed it from yum after adding the centos repos. There is a repo config generator at https://shibboleth.net/downloads/service-provider/RPMS/ https://shibboleth.net/downloads/service-provider/RPMS/ that I used. It installs as an apache module and I am building a flow from my load balancers to hit the apache/SP and proxy some traffic to the application after authentication success so we can create our login session. I have a PoC going now, but the documentation is not terribly clear to me and it is really confusing me about some options I need to tune. For my initial testing, I built the SP and used https://samltest.id/ https://samltest.id/ to test against an IDP. Shibboleth SP docs: https://wiki.shibboleth.net/confluence/display/SP3/Home https://wiki.shibboleth.net/confluence/display/SP3/Home
- maxymajzr 7y agoYou're reading the entire spec, but the flow is what's trivial. 2 systems are exchanging info, they use cryptograhpy to assert that message is coming from a valid, registered resource and the message carrier format is XML. You ask for info, you get XML back, verify the sender and if correct trust the info is valid. That's the gist of the protocol and the tedious part is parsing the XML you receive.
- kabes 7y agoThe flow/concept is simple indeed. But with saml the devil is really in the details and they created way too many details by offering way to many options in the spec.
- i2shar 7y agoWhat's the best practice on when a user session is destroyed at the SP's end? After receiving the LogoutResponse from IdP or before sending the LogoutRequest to IdP?