如何使用Web应用程序作为客户端向SAML依赖方进行身份验证

Question

I have been researching this topic for a while without much luck.

Scenario: 1. Login to a Web Application with using standard form authentication. 2. Login from the Web Application to a SAML Relying Party.

Issue: I thought about using an iFrame to perform the authentication to the SAML Relying Party. The fundamental issue in this approach is that after finalizing the SAML authentication flow, I need to transfer a persistent authentication token back to my Web Application client (this token is used for subsequent access of my Web Application to the SAML relying party).

. Can someone comment on whether this is the right approach (security wise)?

. Is there an alternative approach for authenticating web based clients to a system configured as a SAML relying party?

Thanks in advance,

Saimon

Answer 1

The question you are asking is a fundamental federation question. In terms of SAML, there is an Identity Provider (IdP) and a Service Provider. The IdP has the responsibility to authenticate the user and issue SAML assertions to SP web applications. In your question, it sounds like your application is the IdP that desires to issue a SAML assertion to the SP web application (I interpreted your SAML relying party to mean the SP web application). Keep in mind that SAML assertions are focused on one time usage for authentication to a SP web application where the SAML assertion can contain attributes used for AuthZ.

Another architecture would be to integrate a third party SAML IdP, such that your application is an SP and the other application is an SP. Both of the SP web application would use the IdP for AuthN and receive SAML assertions. Again, this is about AuthN and one time usage of the information in the SAML assertion.

Another architecture would be to leverage OpenID Connect (OIDC) from an IdP Server. The main difference is that the tokens can be long lived and used for subsequent secure API transactions.

With respect to security, all of these protocols have security built into them when integrated properly for their respective architecture.

Answer 2

The Problem is, as far as i understand: His application is a consumer who want to access a ressource which is secured and needs a authentication based on SAML.

You could do the authentication automatically in the background, but then you have to deal with CORS on both sides (Identity Provider and Service Provider). Your Approach is easier, since it is a user started action an therefore CORS is not necessary. To your Problem: Sounds like your Token is part of the header as a special Header with a specific Name. Better approach in your case (if possible): STore this token in a Cookie. In your approach the cookie should be shared between the different frames. Your Application then can send the cookie when accessing the resource. But be aware: Using Javascript & XMLHTTPREQUEST you need to set "withCredentials".