CODEWITHSUNDEEP
samlsaml-2.0
user406570
user406570

Reputation:

Using SAML Security Context for API Calls

Assume we have the following entities:

The goal is to have the Web Application (SP1) being a "Front End" for the User, allowing them to access Resources through the Web Application (SP1) from the Resource Portal (SP2), without the user directly interacting with SP2. SP1 would therefore act as a kind of "Proxy" for SP2 and impersonate the logged-in user for the proxied requests.

Does SAML support this kind of use case? Is there any way to propagate the Security Context which was established on SP1 to SP2 (or any other mechanism that would allow the impersonated requests)? Based on my current understanding, the user would still need to establish a security context for SP2.

Upvotes: 0

Views: 266

Answers (2)

Darshani Jayasekara
Darshani Jayasekara

Reputation: 741

After successfuly authenticated via IDP, you have to perform a local authentication based on the assertions you received.

If you are are working on asp.net core application, you can use shared cookie concept and share the auth cookie which is created by local SP1 login with SP2. You can use Data Protection Service to store the shared key.

Upvotes: 0

Andrew K.
Andrew K.

Reputation: 3341

SAML doesn't really care what you do with the assertion. As the SP, you can choose how you wish to use that assertion, and how to communicate it further upstream.

If it were me, I would use a standard SP token provider (Ping, Okta, etc.) to consume the IdP's SAML. Switch SP1 and SP2 to use OIDC and OAuth respectively, and then use the access token from the OIDC flow on the backend API calls.

Upvotes: 0

Related Questions