如何使用 SAML 对 Windows Forms 客户端进行身份验证？

Question

I have been looking into using an identity provider (IDP) to provide user authentication for a Windows Forms client. The user credentials will be hosted by Auth0. After creating a trial account with Auth0 I have downloaded a sample C# Windows Forms client application that can be used to authenticate to the Auth0 IDP using OpenID Connect ("OIDC"). The WinForms sample application pops up a web browser component, displays the Auth0 login screen, I login to the Auth0 IDP (having setup some test credentials in Auth0) and the WinForms application then is sent an authentication token. All well and good, and if I try to login a second time I no longer need to enter my credentials.

However... the company that I will be fetching authentication data from in production would like to use SAML. Is there any way to do this? Based on what I have read, SAML needs a "Service Provider" that will receive credentials from the IDP. The Service Provider is (typically?) a web site. That does not seem to match very well with what I am trying to do (authenticate a windows client). Is there any way of using SAML to do essentially what I have done using OIDC (fetch authentication information for a user from an IDP)? Would I need to develop a separate Service Provider component for this?

Answer 1

Sounds like what you've done so far is fine architecturally:

• A modern desktop app following OIDC standards

This puts you in a good position architecturally, where:

• Your app gets tokens from Auth0 using OIDC
• Auth0 can reach out and do federated authentication with other standards based identity providers, which could be SAML, OIDC, WS-Federation or anything else
• This can be done without changing any code in your app - and your app does not need to understand SAML

Feels like you need to set up a federated connection from Auth0 to the SAML Service Provider, and most commonly this involves these steps:

• You give the partner your Entity Id and Response URL, to post tokens to
• They give you am Entity Id, Public Key Certificate and request URL
• You configure rules around account linking, so that users can be matched between their system and yours

There are prerequisites though, and the external identity provider needs to be SAML 2.0 compliant. My Federated Logins Article may help you to understand the general concepts, though I do not drill into SAML details here.