Implementing SSO in my application and from app-1 i need to make a rest call to app-2. Login in app-1 with SAML and authenticated successfully and trying for rest call from app-1 with openid but since authentication is using saml only so not able to get the access/bearer token. Please help how to get the access/bearer token from saml request/response. I'm using Keycloak Server for SSO implementation.
You can't.
REST API need a JWT token not a SAML one.
Change SAML to OpenID Connect and it will work.
(1) OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.
(2) Presently there is no IETF draft document regarding SAML 2.0 Profile for OpenID Connect client.
We can refer to the IETF draft document SAML 2.0 Profile for OAuth 2.0 client.
The OAuth 2.0 Access Token using SAML Assertion filter enables an OAuth client to request an access token using a SAML assertion. This supports the OAuth 2.0 SAML flow, which is used when a client wishes to utilize an existing trust relationship, expressed through the semantics of the SAML assertion, without a direct user approval step at the authorization server. For more details on supported OAuth flows, see API Gateway OAuth 2.0 authentication flows.
(3) Both Auth0 and open-source WSO2 Identity Server implement the SAML profile for OpenID Connect/OAuth to convert SAML token to OpenID Connect/OAuth token, as demonstrated by Auth0 SAML Configuration and WSO2 Adding and Configuring an Identity Provider. In other words, Auth0 and WSO2 Identity Server can relay SAML authentication provided by SAML IdP to either OpenID Connect client or OAuth 2.0 client.
Related
Just started POCing KeyCloak to hook up LDAP for user federation (really easy!) and set up a SAML Service Provider with Node.JS (took a bit more time to get the config right). See POC
Question:
Using KeyCloak as the sole Identity Provider, is it possible to set up a 3rd party service (Appian) as a SAML Service Provider, and use the SAML Username and/or Token(session_index) it receives to request an OAuth Token?
Preferably the 3rd party (trusted) service, behind the scenes, would make the OAuth request (with a client id?) to get an access token, and use the token to make API calls.
Seems like there could be two KeyCloak clients, one for SAML, one for OAuth, but then KeyCloak would be able to coordinate the auth under the covers.
You can exchange a SAML assertion (NOT its decoded contents) for an oAuth access token. This flow is described in RFC 7522 (SAML 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants). In practice, this is an exotic use case and it's hard to implement. It assumes that the requester (client) has a way to acquire a SAML response from the IdP and wield it to grab an oAuth access token. To top it off, there are precious few IdPs that support RFC 7522 exchange. At the moment, Keycloak does not support it.
A more straightforward variation of the use case you're thinking about is an ability of a client to request any token (SAML, oAuth, ...) from an identity provider/authorization service without reauthenticating. This is possible with some providers but these mechanisms are proprietary to each provider. For example, Salesforce Identity service allows various tokens to be obtained if you send a request with a Salesforce session ID in a specific format.
We have a coldfusion API which we want to be accessible with OAuth2.0 Access Token Functionality with ADFS.
I am unable to find any library related to OAuth Access Token Validation against a certificate or expiry status.
Is it possible to exchange an OAuth2 access token (or OpenID Connect id_token) for a WS-* SAML token?
Here is our specific scenario that we would like to accomplish:
A user has been authenticated using an OpenID Connect endpoint and issued an id_token.
The same user has been authorized using an OAuth 2 endpoint and issued an access token.
A single-page application (SPA) requests data from a secured ASP.NET Web API and it sends the id_token and access token.
Here's the question/tricky part: We would like the ASP.NET Web API to fetch data from a WCF service that is secured using WS-*, so the WCF service requires a signed SAML token.
Is it possible to exchange the OpenID Connect id_token and/or the OAuth 2 access token for a SAML token that conforms to WS-* specifications?
We would like to use ADFS on Windows Server 2016, but we're also open to other secure token services (STS), such as Azure ADFS, etc.
It seems that you could implement access token exchange in your OAuth server as there is nothing in the spec strictly forbidding it.
OAuth doesn't make any explicit specifications for what shape your access token or refresh tokens are in. So you could use WS-* or whatever suits your client/RP needs.
You could use any of these types of tokens:
WS-Security tokens, especially SAML tokens
JWT tokens
Custom tokens
The id_token itself MUST be a JWT, however.
Like the Kerberos tickets, is it possible to forward to another application:
a SAML assertion
an OAuth token
Thank you,
SAML Assertions: Yes, one such protocol is WS-Trust where the Security Token Service (STS) generates SAML assertions and they can be presented to an end service (i.e. relying party) that trusts the STS. Another is the "SAML 2.0 Bearer Assertion Profile" for OAuth - simply, the SAML grant type - in which you can present the SAML assertion (usually got through SAML Web SSO) to the OAuth endpoint and exchange it to an Access Token.
OAuth Tokens: I'm not sure about a standard use case for this.
I have an application that understands OAuth 2.0 token (on passing a valid OAuth 2.0 token, it authenticates a user) returned by Live ID .
This OAuth toke looks like -
"78wcH%2by1t6avE8zhVCzXQndK2zWJbCWvoZbSKfAduQuyQETUG2FtN5FOw%2bKaj5uCwUfuOS/2J35NvhDkZaaqoOzOVuoTYUDZgAACNzcJuSyBR21CAE9LpBrltj0PljQ76Hd9aJXW8x8DtRsKZvOn76PN69oGDzrGIjXXPIyCGDii9TYmP92kmh50B05qTqhdLiAXcluriQWuEMKONPUVazSmFN2BXZVW3NDdk3vkos8m68SXf%2"
Now I have another application which is based on Azure ACS mechanism. I can get SAML or SWT token from there.
Sample SWT tokens can be found here
Is there any method I can convert the SAML/SWT tokens to the former OAuth 2.0 token?
Note: I tried fetching SWT tokens via OAuth v2-13 protocol, but this token is not validated by the service accepting OAuth token.
Found it.
ACS doesnot expose any API which converts a SAML token to an OAuth 2.0 token.
The possible alternative is that on receiving a SAML token, break open the token, verify the authenticity of the user and successively, fetch OAuth token for the user using live id APIs.
It will definitely double the latency for your signin process.