[{"data":1,"prerenderedAt":238},["ShallowReactive",2],{"post-en-2024-08-25-saml-sso":3},{"post":4,"newer":231,"older":234,"hasTranslation":237},{"id":5,"title":6,"body":7,"cardImg":214,"date":215,"description":214,"excerpt":216,"extension":217,"figCaption":214,"img":218,"lang":219,"listed":220,"meta":221,"navigation":220,"path":225,"readingTime":119,"seo":226,"slug":227,"stem":228,"tagList":229,"__hash__":230},"posts\u002Fposts\u002Fen\u002F2024-08-25-saml-sso.md","SSO Workflow using SAML",{"type":8,"value":9,"toc":201},"minimark",[10,14,17,22,25,29,32,36,46,49,55,58,62,67,74,78,81,84,88,106,109,114,117,123,134,144,149,153,165,170,173,176,179,185,188,191,195],[11,12,13],"p",{},"Authentications are required for any application to store session or data attributing them to the user. The account is typically utilised to grant permission to private information, that could reside in a system, or a document itself.",[11,15,16],{},"This authentication has numerous methods. Basic authentication utilzing a username and password all the way to a federated active directory. These different ways achieves the same goal: allow a user to gain access to closed information; some providing more advantages over the other.",[18,19,21],"h2",{"id":20},"what-is-sso","What is SSO?",[11,23,24],{},"To allow enterprise to maintain a single user management system and employees to use their corporate account to login to 3rd-party services without creating new accounts\u002Fcredentials.",[18,26,28],{"id":27},"what-is-saml","What is SAML?",[11,30,31],{},"Security assertion Markup Language is the most commonly used authentication protocol.",[18,33,35],{"id":34},"_3-subjects-in-the-picture","3 subjects in the picture",[37,38,39,43],"ol",{},[40,41,42],"li",{},"Identity Provider (IdP)",[40,44,45],{},"Service provider (SP)",[11,47,48],{},"The application that trusts the IdP and wants to use IdP for authentication.",[37,50,52],{"start":51},3,[40,53,54],{},"Principal",[11,56,57],{},"The user trying to log into SP via IdP",[18,59,61],{"id":60},"_2-types-of-authentication-workflow","2 Types of Authentication Workflow",[63,64,66],"h3",{"id":65},"idp-initiated-login","IdP initiated Login",[11,68,69,70,73],{},"Principal goes into IdP and view the list of SP he has access to.",[71,72],"br",{},"\nChoosing the SP, they will be redirected to that SP",[63,75,77],{"id":76},"sp-initiated-login","SP initiated Login",[11,79,80],{},"User goes to SP website and if there is no active session with SP, the user will be redirected to IdP for authentication.",[11,82,83],{},"On successful login, the principal will be redirected back to SP",[18,85,87],{"id":86},"sp-initiated-login-workflow","SP Initiated Login workflow",[89,90,91,94,97,100,103],"ul",{},[40,92,93],{},"Check for SP active session",[40,95,96],{},"SP sends authentication Request to IdP",[40,98,99],{},"IdP authenticates the user",[40,101,102],{},"IdP sends SAML Assertion to SP",[40,104,105],{},"SP creates session and logs in user",[11,107,108],{},"SAML does not maintain sessions so SP has to main.",[37,110,111],{},[40,112,113],{},"SP check if there’s an active session",[11,115,116],{},"Note that SAML do not store sessions, thus only done by the Service Provider (SP).",[37,118,120],{"start":119},2,[40,121,122],{},"SP sends AuthRequest to IdP. Clicking on Login, SP generates an XML message called AuthnReuqest with details:",[89,124,125,128,131],{},[40,126,127],{},"Who sent the request (Issuer)",[40,129,130],{},"Where to redirect to after authentication (Assertion Consumer Service URL)",[40,132,133],{},"Security Measures (ID, issueInstant)",[11,135,136,137],{},"An example of XML message ",[138,139,143],"a",{"href":140,"rel":141},"https:\u002F\u002Fwww.samltool.com\u002Fgeneric_sso_req.php",[142],"nofollow","here",[89,145,146],{},[40,147,148],{},"Encoded in URL-safe string, embedded as query param in the request to Idp and user related to the IdP Url indicated on SP side.",[37,150,151],{"start":51},[40,152,99],{},[11,154,155,156,158,159,161,162,164],{},"IdP maintains its own session about the user.",[71,157],{},"\nIf an active session exists for user, the user is redirected to SP.",[71,160],{},"\nIf session do not exists, the user is asked for credentials",[71,163],{},"\nIdP can be configured for different types of authentication: basic auth, Totp, MFA",[37,166,168],{"start":167},4,[40,169,102],{},[11,171,172],{},"Once principal is authenticated, IdP sends back an XML message called SAML Assertion to SP’s Assertion Consumer Service URL.",[11,174,175],{},"This SAML Assertion contains principal details: name, email departments. - this can be confirmed on SP on what SP wish to request from IdP.",[11,177,178],{},"SAML Assertion is digitaly signed so the SP can trust the message is indeed from IdP and login the user into their system.",[37,180,182],{"start":181},5,[40,183,184],{},"SP creates session and login user",[11,186,187],{},"User is redirected back from IdP to SP. SP creates a session to keep user logged in.",[11,189,190],{},"——",[63,192,194],{"id":193},"reference","Reference:",[11,196,197],{},[138,198,199],{"href":199,"rel":200},"https:\u002F\u002Fwww.sheshbabu.com\u002Fposts\u002Fvisual-explanation-of-saml-authentication\u002F",[142],{"title":202,"searchDepth":119,"depth":51,"links":203},"",[204,205,206,207,211],{"id":20,"depth":119,"text":21},{"id":27,"depth":119,"text":28},{"id":34,"depth":119,"text":35},{"id":60,"depth":119,"text":61,"children":208},[209,210],{"id":65,"depth":51,"text":66},{"id":76,"depth":51,"text":77},{"id":86,"depth":119,"text":87,"children":212},[213],{"id":193,"depth":51,"text":194},null,"2024-08-25","Authentications are required for any application to store session or data attributing them to the user. The account is typically utilised to grant permission to private…","md","https:\u002F\u002Fplus.unsplash.com\u002Fpremium_photo-1661877737564-3dfd7282efcb","en",true,{"layout":222,"fig-caption":214,"tags":223},"post",[224],"tag","\u002Fposts\u002Fen\u002F2024-08-25-saml-sso",{"title":6,"description":214},"2024-08-25-saml-sso","posts\u002Fen\u002F2024-08-25-saml-sso",[],"GDKHPwqd99Uc7Kd_Afg-9Iu4BQeqR7uJn2dWZEdbYCE",{"slug":232,"title":233},"2024-09-30-sep-articles","Articles of Sep",{"slug":235,"title":236},"2024-07-03-articles-of-june","May-Jun has not been the easiest",false,1794023764383]