Sign in an Authenticated User from External SP with SAML SSO using ITfoxtec to the managed SP

user_11172875 0
Viewed 230

My team is tasked with implementing SSO into our web application (full .net 4.8 hosted in Azure). However, we need to rely on authentication of an external application.

A bit of context. Imagine there are 2 separate companies (A and B) which have separate web apps (SP_A and SP_B). We are the company B in this context.

Here is the requested workflow:

  1. A user of SP_A logs in SP_A. Authentication process is unknown to us.
  2. This user wants to log in to SP_B without typing password and email (stored to authenticate them in SP_B).
  3. They click on a button somewhere in SP_A and "magically" it signs them into our SP_B without any prompts.

We have accomplished that with JWT tokens nested in Authorization headers. Here is what happens behind the scenes:

  1. A user presses the button in SP_A which makes a call to our REST API. Request has 2 parameters: a. API Key (we provide it to company A), b. Company Name
  2. The API confirms that API key is assigned to a said company (A) and issues a JWT
  3. JWT token is returned to the client and is included in the auth headers with all subsequent requests
  4. The next request to our API contains user email and org name. API verifies that such user exists in our DB as well, authenticates and signs them into out SP_B web app.

Our client requested that we use SAML2.0 protocol instead.

I am using ITfoxtec sample projects as a starting point, but I am quite lost. All external articles want to enable one centralized IdP which would prompt a user for password and email once and Claims will be passed from IdP to SPs. It does not apply to our case, since users are auth-ed in SP_A app.

Thoughts?

itfoxtec-identity-saml2 saml-2.0 single-sign-on .net c#
1 Answers

if SP_A and SP_B are using the same IdP and both implement SAML or OIDC SSO, then you are good.

The logic is like this: when user successfully logins to SP_A, the browser will get two sessions: one session for SP_A and one session for IdP.

When the user tries to login to SP_B, the browser will redirect the user to login to IdP, since IdP knows the user has already logged in, it will not prompt the login page. And then SP_B can also issue a session to this user.

user_39735240
Related