On 05/27/2015 01:21 PM, Nathan Kinder wrote:
>
> On 05/27/2015 10:17 AM, Nathan Kinder wrote:
>>
>> On 05/27/2015 10:11 AM, Simo Sorce wrote:
>>> On Wed, 2015-05-27 at 09:50 -0700, Nathan Kinder wrote:
>>>> On 05/27/2015 06:32 AM, John Dennis wrote:
>>>>> On 05/27/2015 01:43 AM, Eric Heydrick wrote:
>>>>>> I am attempting to setup SSO with SAML to the AWS Console using
the
>>>>>> guide at [1]. I have Ipsilon configured to auth against FreeIPA
>>>>>> and can
>>>>>> login to /idp successfully. My problem is that Amazon expects
the
>>>>>> IdP to
>>>>>> initiate the login but it seems that Ipsilon expects the SP to
>>>>>> initiate
>>>>>> the login. How would I accomplish this with Ipsilon?
>>>>>>
>>>>>> -Eric
>>>>>>
>>>>>> [1]
>>>>>>
http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
>>>>>>
>>>>> You are correct, the above is not a normal SAML Web SSO flow which
at
>>>>> the moment is all that Ipsilon supports. This can be accomplished
>>>>> with
>>>>> SAML ECP logic in your application. Using ECP you would generate an
>>>>> AuthnRequest message and post it to Ipsilon which then would post
>>>>> back a
>>>>> SAML assertion you can POST to AWS. Your application has to be
>>>>> able to
>>>>> receive POST messages.
>>>> This is not an ECP case as far as I can see. This appears to just be
>>>> IdP initated SSO:
>>>>
>>>>
>>>>
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-...
>>>>
>>>>
>>>> We would need the ability to register SP links in Ipsilon that can be
>>>> used to perform IdP initiated SSO when clicked. The way I see this
>>>> working would be:
>>>>
>>>> - User goes to Ipsilon and logs in.
>>>>
>>>> - Registered SPs that support IdP initiated SSO are shown as links.
>>>>
>>>> - User clicks on desired SP link, which generates an assertion and
>>>> does
>>>> a POST to the SP (using a configurable IdP intiated URL in the SP
>>>> config)
>>>>
>>>> From a UI/configuration standpoint, I envision a checkbox on the SP
>>>> config page to enable IdP initiated SSO per-SP. If this is
>>>> checked, you
>>>> can fill in a POST URL and the text to display for the link (a
>>>> configurable image would be a nice addition too).
>>> The POST url should come from the SP metadata file (at least by
>>> default), otherwise I agree.
>> OK. I was wondering about that too. If it's just the normal endpoint
>> in the SP metadata, we should definitely use it.
> I've filed a ticket for this in trac:
>
>
https://fedorahosted.org/ipsilon/ticket/138
>
> This seems like a very good 1.1 candidate.
Where would that list of SP URLs be displayed? On the first page where
the picture is?
The picture you are referring to is only seen by admins. If you go to
Ipsilon and log in as a normal user, you just get a plain page with
almost nothing on it right now. You'll see what I mean if you try it on
the public demo with a non-admin user. This is where the links would be
displayed.
>
>>> Simo.
>>>
>> _______________________________________________
>> ipsilon mailing list
>> ipsilon(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>>
> _______________________________________________
> ipsilon mailing list
> ipsilon(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/ipsilon