On 05/27/2015 10:28 AM, Dmitri Pal wrote:
> On 05/27/2015 01:21 PM, Nathan Kinder wrote:
>> On 05/27/2015 10:17 AM, Nathan Kinder wrote:
>>> On 05/27/2015 10:11 AM, Simo Sorce wrote:
>>>> On Wed, 2015-05-27 at 09:50 -0700, Nathan Kinder wrote:
>>>>> On 05/27/2015 06:32 AM, John Dennis wrote:
>>>>>> On 05/27/2015 01:43 AM, Eric Heydrick wrote:
>>>>>>> I am attempting to setup SSO with SAML to the AWS Console
using the
>>>>>>> guide at [1]. I have Ipsilon configured to auth against
FreeIPA
>>>>>>> and can
>>>>>>> login to /idp successfully. My problem is that Amazon expects
the
>>>>>>> IdP to
>>>>>>> initiate the login but it seems that Ipsilon expects the SP
to
>>>>>>> initiate
>>>>>>> the login. How would I accomplish this with Ipsilon?
>>>>>>>
>>>>>>> -Eric
>>>>>>>
>>>>>>> [1]
>>>>>>>
http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
>>>>>>>
>>>>>> You are correct, the above is not a normal SAML Web SSO flow
which at
>>>>>> the moment is all that Ipsilon supports. This can be
accomplished
>>>>>> with
>>>>>> SAML ECP logic in your application. Using ECP you would generate
an
>>>>>> AuthnRequest message and post it to Ipsilon which then would
post
>>>>>> back a
>>>>>> SAML assertion you can POST to AWS. Your application has to be
>>>>>> able to
>>>>>> receive POST messages.
>>>>> This is not an ECP case as far as I can see. This appears to just
be
>>>>> IdP initated SSO:
>>>>>
>>>>>
>>>>>
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-...
>>>>>
>>>>>
>>>>> We would need the ability to register SP links in Ipsilon that can
be
>>>>> used to perform IdP initiated SSO when clicked. The way I see this
>>>>> working would be:
>>>>>
>>>>> - User goes to Ipsilon and logs in.
>>>>>
>>>>> - Registered SPs that support IdP initiated SSO are shown as links.
>>>>>
>>>>> - User clicks on desired SP link, which generates an assertion and
>>>>> does
>>>>> a POST to the SP (using a configurable IdP intiated URL in the SP
>>>>> config)
>>>>>
>>>>> From a UI/configuration standpoint, I envision a checkbox on the
SP
>>>>> config page to enable IdP initiated SSO per-SP. If this is
>>>>> checked, you
>>>>> can fill in a POST URL and the text to display for the link (a
>>>>> configurable image would be a nice addition too).
>>>> The POST url should come from the SP metadata file (at least by
>>>> default), otherwise I agree.
>>> OK. I was wondering about that too. If it's just the normal endpoint
>>> in the SP metadata, we should definitely use it.
>> I've filed a ticket for this in trac:
>>
>>
https://fedorahosted.org/ipsilon/ticket/138
>>
>> This seems like a very good 1.1 candidate.
> Where would that list of SP URLs be displayed? On the first page where
> the picture is?
The picture you are referring to is only seen by admins. If you go to
Ipsilon and log in as a normal user, you just get a plain page with
almost nothing on it right now. You'll see what I mean if you try it on
the public demo with a non-admin user. This is where the links would be
displayed.
>>>> Simo.
>>>>
>>> _______________________________________________
>>> ipsilon mailing list
>>> ipsilon(a)lists.fedorahosted.org
>>>
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>>>
>> _______________________________________________
>> ipsilon mailing list
>> ipsilon(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>
_______________________________________________
ipsilon mailing list
ipsilon(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
--
Thank you,
Dmitri Pal
Director of Engineering for IdM portfolio
Red Hat, Inc.