Accepting a SAML 1.1 Assertion

views:

132

answers:

+1 Q:

Accepting a SAML 1.1 Assertion

Hi,

I am working on providing a SSO solution to a customer who acts as an identity provider. He already has Siteminder on his side to generate SAML 1.1 assertions with user id and timestamp as parameters. Our task is to accept this assertion which is signed, decrypt it and send it to the authenticator we already have. The authenticator validates the info and gives access to our application. Here we act as the service provider.

I am new to SAML and have no idea how to integrate SAML to our current ASP login pages. Can u help me on how to accept these assertion requests from the Idp. They are using SAML/POST profile.

Thanks, king

ASP login? Oh dear, you will have to manually decrypt, validate and accept/decline the token, and then map the user to whatever role based mechanism your application uses.

If you were on ASP.NET then the Windows Identity Framework would help.

blowdart 2009-11-23 16:13:05

They have an encryption algorithm and are sharing the key with us. The only thing i have to do is decrypt the two parameters and pass them over to the authenticator.asp page we already have that authenticates the user and passes them to the target URL.

king 2009-11-23 17:07:44

It's not that simple. SAML tokens are wrapped in WS-Secure, so you need to pick that apart. They should be encrypting against a public key you supply, and signing with a key pair where they supply you with the public key.In any case VBScript support for these types of functions are minimal

blowdart 2009-11-23 17:10:09

Ping Identity offers a commercial, out of the box solution to support this use case - PingFederate. This type of use case could be implemented in a just a couple of hours with no custom code. Check out www.pingidentity.com for more information.

Sergei 2009-12-07 15:00:18

ansaurus

tags:

views:

answers:

Accepting a SAML 1.1 Assertion

related questions