On 05/27/2015 10:17 AM, Nathan Kinder wrote:
>
> On 05/27/2015 10:11 AM, Simo Sorce wrote:
>> On Wed, 2015-05-27 at 09:50 -0700, Nathan Kinder wrote:
>>> On 05/27/2015 06:32 AM, John Dennis wrote:
>>>> On 05/27/2015 01:43 AM, Eric Heydrick wrote:
>>>>> I am attempting to setup SSO with SAML to the AWS Console using the
>>>>> guide at [1]. I have Ipsilon configured to auth against FreeIPA and
can
>>>>> login to /idp successfully. My problem is that Amazon expects the IdP
to
>>>>> initiate the login but it seems that Ipsilon expects the SP to
initiate
>>>>> the login. How would I accomplish this with Ipsilon?
>>>>>
>>>>> -Eric
>>>>>
>>>>> [1]
http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
>>>> You are correct, the above is not a normal SAML Web SSO flow which at
>>>> the moment is all that Ipsilon supports. This can be accomplished with
>>>> SAML ECP logic in your application. Using ECP you would generate an
>>>> AuthnRequest message and post it to Ipsilon which then would post back a
>>>> SAML assertion you can POST to AWS. Your application has to be able to
>>>> receive POST messages.
>>> This is not an ECP case as far as I can see. This appears to just be
>>> IdP initated SSO:
>>>
>>>
>>>
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-...
>>>
>>> We would need the ability to register SP links in Ipsilon that can be
>>> used to perform IdP initiated SSO when clicked. The way I see this
>>> working would be:
>>>
>>> - User goes to Ipsilon and logs in.
>>>
>>> - Registered SPs that support IdP initiated SSO are shown as links.
>>>
>>> - User clicks on desired SP link, which generates an assertion and does
>>> a POST to the SP (using a configurable IdP intiated URL in the SP config)
>>>
>>> From a UI/configuration standpoint, I envision a checkbox on the SP
>>> config page to enable IdP initiated SSO per-SP. If this is checked, you
>>> can fill in a POST URL and the text to display for the link (a
>>> configurable image would be a nice addition too).
>> The POST url should come from the SP metadata file (at least by
>> default), otherwise I agree.
> OK. I was wondering about that too. If it's just the normal endpoint
> in the SP metadata, we should definitely use it.
I've filed a ticket for this in trac:
https://fedorahosted.org/ipsilon/ticket/138
This seems like a very good 1.1 candidate.
Where would that list of SP URLs be displayed? On the first page where
the picture is?
>> Simo.
>>
> _______________________________________________
> ipsilon mailing list
> ipsilon(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>
_______________________________________________
ipsilon mailing list
ipsilon(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
--
Thank you,
Dmitri Pal
Director of Engineering for IdM portfolio
Red Hat, Inc.