Questions tagged [saml]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
21 views

How to integrate multiple services via API's into a single dashboard on a per-user basis with SSO?

so my project is that I'd like to pull data from a bunch of different services/API's and show them in a single dashboard. SSO is a requirement so I want to make sure the user doesn't have to put in ...
0 votes
1 answer
1k views

Best way to store Session token on mobile App

Background Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
  • 109
0 votes
0 answers
54 views

Is it a good practice to store session in two different places?

I have a use case like this and I am wondering if this solution is a good practice or not. Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
4 votes
0 answers
919 views

How to implement SAML Authentication SPA and REST Backend

Developing a SPA (with VueJS) that is talking to our own REST API Backend(Separate server). Normal authentication flow in the SPA: User credentials after submission are sent to the backend and if ...
  • 141
4 votes
2 answers
451 views

Integration with multiple SSO's

Currently, we had a web app that integrated with SSO through Open-Id protocol Then we got another client that had it's own SSO and need us to integrate with their SSO through SAML protocol so their ...
2 votes
1 answer
120 views

Why do we need to validate the SAML Response that came from IdP? (unless you are using http)

I came across several cases where people are validating the saml response (verifying the signatures in the xml using the IdP's public key). But, Why do we need to do that? (unless http is being used) ...
1 vote
0 answers
83 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
  • 19
2 votes
2 answers
2k views

How to secure web services when authentication is done at client side (frontend)

I have web application which structure is as- webapi : django web services [NOT REST] no security implemented frontend : Angular2. authentication implemented via SAML Database : Mongodb Can you ...
2 votes
1 answer
595 views

Should an Identity Provider be a separate web application than a Authentication system

I'm currently writing a SAML Identity provider(Idp) to enable SSO and one of the easy ways to go about it is to use Shibboleth Identity Provider which is a ready deployable web application on it's own....
  • 123
0 votes
1 answer
3k views

What should be specified in the Saml AuthnRequest Issuer element

While generating the SamlRequest xml, what should the Issuer element be specified with? In the saml docs (https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf), Issuer was not ...
3 votes
3 answers
3k views

Moving between sites using SAML

I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a ...
  • 4,743
3 votes
2 answers
177 views

For ASP.NET Programmers: Does the executable 'dcpromo' have any significance?

Dcpromo.exe is famous among MCSEs for being they only way to create a Windows Domain Controller (in other words an Active Directory Domain) ... which in turn is often used by the ASP.NET Membership ...
2 votes
3 answers
6k views

What product is better: ADFSv2, Ping Identity, CS Siteminder? [closed]

I'm comparing different STS's for claims based authentication and am trying when it's appropriate to use each one. It appears that ADFSv2 should be used in all Windows Environments. Ping and ...