Rails - Using omniauth-saml with multiple IDPs - ruby-on-rails

Question

What I'm trying to have in the end is the ability to login normally with devise OR choose to login with SAML. So I read that if I integrate omniauth and saml, then omniauth and devise, I could achieve that.
My problem is, that I have different IDPs that I would like to choose from. So I don't have one :idp_sso_target_url, but many. So my question is how can I dynamically change the value of the target_url. Currently the omniauth-saml gem defines this value in the config/initializers directory..
Thank you,

Answer 1

You can store settings for every provider in db, and then configure omniauth in the setup phase at request-time. For example:
SETUP_PROC = lambda do |env|
request = Rack::Request.new(env)
user = User.find_by_subdomain(request.subdomain)
env['omniauth.strategy'].options[:consumer_key] = user.consumer_key
env['omniauth.strategy'].options[:consumer_secret] = user.consumer_secret
end
use OmniAuth::Builder.new do
provider :twitter, :setup => SETUP_PROC
end
See https://github.com/intridea/omniauth/wiki/Setup-Phase for more information.

Answer 2

Using multiple SAML IDPs with Devise + OmniAuth:
Follow this official guide for Single IDP.
https://github.com/omniauth/omniauth-saml#devise-integration
Once you have your SP working with single IDP, do following tweaks
In devise initializer
config.omniauth :first, {
name: :first,
strategy_class: ::OmniAuth::Strategies::SAML,
#Rest of the config as per omniauth-saml guide
assertion_consumer_service_url: '/users/auth/first/callback'}
config.omniauth :second, {
name: :second,
strategy_class: ::OmniAuth::Strategies::SAML,
#Rest of the config as per omniauth-saml guide
assertion_consumer_service_url: '/users/auth/second/callback'}
In Users::OmniauthCallbacksController, add actions named first and second in instead of saml as suggested in official guide.
In your User model:
devise :omniauthable, omniauth_providers: [:first, :second]
If all configured correctly, you now have your SP configured for two IDPs.

Answer 3

Rails.application.config.middleware.use OmniAuth::Builder do
provider :saml,
name: "first",
assertion_consumer_service_url: "/auth/first/callback",
issuer: "your-app",
idp_sso_target_url: "first.com/idp"
idp_cert_fingerprint: "E7:91:B2:E1:...",
name_identifier_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
provider :saml,
name: "second",
assertion_consumer_service_url: "/auth/second/callback",
issuer: "your-app",
idp_sso_target_url: "second.com/idp",
idp_cert_fingerprint: "E7:91:B2:E1:...",
name_identifier_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
end

Answer 4

If using the application in a federation context there will be most likely a metadata source, such as prescribed in the saml2int.org profile. This metadata has the data to populate IDP discovery (and automatically configure all the IDPs). It seems that omniauth-saml does not support the SAML Metadata specification, therefore some kind of SAML proxy is the alternative.