CODEWITHSUNDEEP
single-sign-onsimplesamlphp
crisis
crisis

Reputation: 11

Single Sign On: SimpleSAMLPhp Service Provider Implementatio

I am implementing a SSO using SimpleSAMLPhp Service Provider.

I provided my metadata to remote Shibboleth Identity Provider and was provided a test account.

When a user visits a specific page on my SP, they get redirected to the IdP, login, and are redirected back to my web site with a bunch of IdP provided attributes. This part works.

This part I am struggling with.

If the user authenticates with the same IdP through a different Service Provider and then visits my page, how do I know they are already authenticated? Currently I am being asked to login again.

Is there a configuration value somewhere that lets me do this? Or am I using the wrong method? This is what I am doing.

$as = new SimpleSAML_Auth_Simple({REMOTE_AUTHSOURCE});
$as->requireAuth(); // this redirects to remote IdP login
$attributes = $as->getAttributes();

Thanks.

Upvotes: 0

Views: 174

Answers (1)

Patrick
Patrick

Reputation: 3981

There are two separate authentication sessions to consider. One session is in you app and the other is at the IdP. The requireAuth method can tell if the user already has an authenticated session in your application, and will return immediately in that case. There is no way for you to tell if a browser has a session at the IdP. You just call requireAuth whichs send the user there and if the IdP decides the user's session is still valid it will respond without prompting for login.

Are you saying that the user has a valid session at the IdP and they are being re-prompted to authenticate when you send the user there? That could be due to IdP policy, or if your app was sending something like 'forceAuth' in its AuthnRequest.

Upvotes: 1

Related Questions