CODEWITHSUNDEEP
oauth-2.0single-sign-onsaml
salvob
salvob

Reputation: 121

Using JWT to authorize REST API requests after SAML Authentication

I'm struggling theese days on the possible way to configure an Authentication + authorization system to consume a REST API from a mobile application.

Scenario: We've developed 3 independent portals for a big customer that serves several users. To enable a SSO for the 3 portals we've implemented a SAML authentication system using SimpleSAMLphp. Every portal has a service provider and they make assertion requests against a central IdP. The IdP checks username and password against a database where passwords are hashed and stored during registration. After the login, the authorization on the portals is handled by the session on the server, and so far everything was fine.

Now the customer asked us to develop a mobile application that will require the users to login and access several of their protected resources collected during the usage of the 3 portals.

We've decided to develop a frontend application using ionic that will consume a REST API made in node.js that will serve all the data (both protected and unprotected resources).

Now here comes the question: to authorize access to protected resources on the Api we'd like to use JWT to easily achieve a stateless system. The doubt is how to perform the authentication? We've the opportunity to check the credentials directly against the database skipping the SAML process, otherwise we've to implement a solution where the SSO IdP acts as authentication provider and then when an attempt is successful the API app will get the response from the idp and then issue a signed jwt to the consumer client. Is this second way a common implementation? Is it possible?

What path do you suggest to follow? The first could be very easy to achieve, but since we're using html+js for the app's frontend, if we decide to use the second solution probably in the near future we could recycle some code from the app to modernize some functions on the web portals, maintaining the jwt pattern and consuming the new Api also on the web. I believe that in this case will be easier to ask a token to the new api using someway the logged in user's data already in the session of the portal. Sounds possible?

I hope that everything was clear, any help will be appreciated!

Thanks

Upvotes: 3

Views: 3796

Answers (1)

Gary Archer
Gary Archer

Reputation: 29218

The key goal here is to code your apps in the best way, via the latest security standards (OAuth 2.0 and Open Id Connect). SAML is an outdated protocol that is not web / mobile / API friendly, and does not fit with modern coding models.

Sounds like you want to do OAuth but you do not have an OAuth Authorization Server, which is a key part of the solution. If you could migrate to one you would have the best future options for your apps.

OPTION 1

Use the most standard and simple option - but users have to login with a new login screen + credentials:

  • Mobile or Web UI uses Authorization Flow (PKCE) and redirects to an Authorization Server to sign the user in
  • Mobile or Web UI receives an access token after login that can be sent to the API
  • Access token format is most commonly a JWT that the API can validate and identify the user from
  • The API is not involved in the login or token issuing processes

OPTION 2

Extend option 1 to federate to your SAML Identity Provider - enables users to login in the existing way:

  • The Authorization Server is configured to trust your SAML based identity provider and to redirect to it during logins
  • The SAML idp presents a login screen and then posts a SAML token to the Authorization Server
  • The Authorization Server issues OAuth based tokens based on the SAML token details

OPTION 3

Use a bridging solution (not really recommended but sometimes worth considering if you have no proper authorization server - at least it gets your apps using OAuth tokens):

  • Mobile or Web UI uses Resource Owner Password Grant and sends credentials to a new OAuth endpoint that you develop
  • OAuth endpoint provides a /oauth/token endpoint to receive the request
  • OAuth endpoint checks the credentials against the database - or translates to a SAML request that is forwarded to the IDP
  • OAuth endpoint does its own issuing of JWT access tokens via a third party library (if credentials are valid)
  • Web or Mobile UI sends JWT access token to API
  • API validates received JWT access token

Upvotes: 4

Related Questions