saml-idp | Simple SAML Identity Provider for Node | Authentication library

I expect you have configured the RP (relying party) to sign the Authn Request, which is optional in the SAML 2.0 standard and only required by som IdPs (identity providers).

If your IdP do not require the Authn request to be signed, I think you should omit it.

If the IdP is implemented by the ITfoxtec Identity SAML 2.0 package. The IdP can be configured to require signed Authn Request with the same configuration saml2Configuration.SignAuthnRequest = true. Therefore, you can test the signing with a test IdP implemented using ITfoxtec Identity SAML 2.0.

Samples:

ASP.NET core RP sample: https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test/TestWebAppCore

ASP.NET core IdP sample: https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test/TestIdPCore

Update: It looks like the Mini Orange WordPress plugin IdP can be configured with a public RP key for Authn Request signature validation in field X.509 Certificate (optional): (For Signed Request) see screenshot.

OIDC tokens returned by Cognito are ID Token and Access Token, both are JWT. You can pass these to your custom backend directly (most commonly in Authorization header).

On the backend you should decode and verify the token using your user pool's public key (JWK). JWK is available at https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json. If token is valid and not expired, you can trust it and use it for custom backend authorization logic.

The whole process of verifying tokens is described here https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html and there are a number of open source libraries which will help you do that.

If the metadata URL /Saml2 responds, the handler is running.

Are you sure that /Saml2/Acs is not accessible? It's not just that there is a configuration error causing the response validation to fail? Do you see anything in the logs?

@nkpatel Yes, using Graph API, you can fetch the value for Immutable ID. In case the user object is sycned from On-Prem AD to AAD, using the AAD Connect Tool, the user object will have an attribute called "onPremisesImmutableId" in the Graph API response for that user.

I'm in the process of implementing an SAML 2.0 identity provider with Symfony 4 as well.

I have chosen to use the LightSaml IdP even though it lacks proper documentation. I plan to draft some documentation myself once the project is done.

At the moment, I have ported LightSaml IdP sample code inside controller actions and proper authentication is done by implementing an AbstractFormLoginAuthenticator class from the Guard feature in Symfony Security component.

I am still scratching my head on how to properly use an incoming SAML authentication request to redirect the user back to the SP once he is authenticated locally on the IdP.

Right now I have chosen to validate the entity ID the user is coming from then initiating a new authentication from the IdP back to the SP. Not the cleanest way, but it works for my usage.

When you define ports:- 8380:8080, it will publish testidpsaml's 8080 port to host's 8380 port. Then, on docker host(not container), you can visit it with localhost:8380.

But, in app service, your code is running in container, then localhost not mean the docker host, but the current container, you could specify replace localhost with your docker host ip to make it work.

In fact, you could also directly specify the service name, because compose will setup a custom network for you:

User-defined bridges provide automatic DNS resolution between containers.

in which it has a internal dns server, which could help container find eathother quickly, no need to use docker host to pass traffic container. For your case, use next:

Question: The SAML SP metadata does not contain a X509 certificate.

How do I get one into the metadata?

Answer:

It is OK that SAML SP metadata of Keycloak does NOT contain a X509 certificate if (I) Keycloak SAML SP does NOT need to sign SAML authentication request or (II) SAML IdP is NOT require to encrypt SAML assertion for Keycloak SAML SP.

(1) SAML SP metadata does NOT necessarily contain a X509 certificate. That is, X509 certificate is NOT mandatory for SAML SP metadata.

For example, both Google G Suite and ComponentSpace provide SAML SP metadata without X509 certificate.

(I) SAML SP metadata of Google G Suite does NOT contain a X509 certificate. I uploaded SAML SP metadata of Google G Suite into Shibboleth SAML IdP server and then logged in to Google G Suite through SAML authentication provided by Shibboleth SAML IdP successfully.

For your reference on SAML SP metadata without X509 certificate, I have made the 14th commit to upload the Google G Suite SAML SP metadata and corresponding SAML configuration to How to build and run Shibboleth SAML IdP and SP using Docker container at GitHub repository.

(II) The ComponentSpace Development provides the guidance on how to generates SAML service provider metadata with no certificates.

No signature or encryption certificates were specified so no certificates were included in the generated metadata.

Finally solved. The Authn Request i sent contained empty "issuer" field and this one was needed on idp side since simpleSAMLphp seemes to store SP Metadata in an array like Metdata['spName']. So of course their was no entry for the empty string as key.

The SAML token is encrypted.

You need to get the client side certificate used for this and use that to decrypt it.