On Wed, 2015-05-27 at 09:50 -0700, Nathan Kinder wrote:
>
> On 05/27/2015 06:32 AM, John Dennis wrote:
>> On 05/27/2015 01:43 AM, Eric Heydrick wrote:
>>> I am attempting to setup SSO with SAML to the AWS Console using the
>>> guide at [1]. I have Ipsilon configured to auth against FreeIPA and can
>>> login to /idp successfully. My problem is that Amazon expects the IdP to
>>> initiate the login but it seems that Ipsilon expects the SP to initiate
>>> the login. How would I accomplish this with Ipsilon?
>>>
>>> -Eric
>>>
>>> [1]
http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
>>
>> You are correct, the above is not a normal SAML Web SSO flow which at
>> the moment is all that Ipsilon supports. This can be accomplished with
>> SAML ECP logic in your application. Using ECP you would generate an
>> AuthnRequest message and post it to Ipsilon which then would post back a
>> SAML assertion you can POST to AWS. Your application has to be able to
>> receive POST messages.
>
> This is not an ECP case as far as I can see. This appears to just be
> IdP initated SSO:
>
>
>
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-...
>
> We would need the ability to register SP links in Ipsilon that can be
> used to perform IdP initiated SSO when clicked. The way I see this
> working would be:
>
> - User goes to Ipsilon and logs in.
>
> - Registered SPs that support IdP initiated SSO are shown as links.
>
> - User clicks on desired SP link, which generates an assertion and does
> a POST to the SP (using a configurable IdP intiated URL in the SP config)
>
> From a UI/configuration standpoint, I envision a checkbox on the SP
> config page to enable IdP initiated SSO per-SP. If this is checked, you
> can fill in a POST URL and the text to display for the link (a
> configurable image would be a nice addition too).
The POST url should come from the SP metadata file (at least by
default), otherwise I agree.
OK. I was wondering about that too. If it's just the normal endpoint
in the SP metadata, we should definitely use it.