SAML simple example for beginners

java security single-sign-on saml-2.0
user2779075 picture user2779075 · Sep 14, 2013 · Viewed 73.2k times · Source

I am beginner to the SAML v2.0 technology and I get the theory knowledge but I didn't find any examples on Google. Can anybody provide me with a step by step example for simple "SAML for v2.0".

  1. Upto now I've gone through the theory part,i.e.., it support Single sign on and
    also I understood about the Service provider and Identity Provider .
  2. Presently I am working on Linux Environment
  3. I need basic example in step by step manner how the request is moving from user -> Identity Provider->Service Provider and how to configure the environment .
  4. Is it possible to execute the example for the SAML v2.0
  5. Is their any chance to execute SAML example in Java language,If it possible you can
    provide the example on Java also.

Answer

Stefan Rasmusson picture Stefan Rasmusson · Sep 15, 2013

Typical SSO with SAML is something called Web SSO Profile. There are many products supporting this on the market for example OpenAM, Shibboleth, OpenSAML and Oracle Identity Federation. The specific configuration is dependant on what product you choose to use. A working example of OpenSAML that I use in my book is availible here.

On a SAML level, the SP and IDP exchanges Metadata which contain configuration information on how the SP and IDP want to communicate.

SSO is then done in four steps:

  1. SP sees that the user does not have an authenticated session.
  2. The SP redirects the user to IDP with a SAML AutnRequest as an URL parameter.
  3. The IDP authenticates the user and redirects it back to the SP with an artifact in URL parameter.
  4. The SP exchanges the Artifact for an Assertion over SOAP using a ArtifactResolveRequest to the IDP.

If you want to code this yourself in Java, you can use OpenSAML. On my blog I have many examples on how to use it.

In my book, A Guide To OpenSAML, I write alot about this

EDIT New edition of the book is out, covering OpenSAML v3

Related questions

How to implement SAML SSO

How is SAML SSO typically implemented? I've read this (n.b. obsolete) about using SAML with Google Apps, and the wikipedia entry on SAML. The wikipedia entry talks about responding with forms containing details of the SAMLRequest and SAMLResponse. Does …

Read More
Java Error: "Your security settings have blocked a local application from running"

I'm trying to run this simple HelloWorld code written in Java from my browser (Chrome): public class HelloWorld extends JApplet { public void init() { try { SwingUtilities.invokeAndWait(new Runnable() { public void run() { JLabel lbl = new JLabel("Hello World"); add(lbl); } }); } catch (…

Read More
Why is char[] preferred over String for passwords?

In Swing, the password field has a getPassword() (returns char[]) method instead of the usual getText() (returns String) method. Similarly, I have come across a suggestion not to use String to handle passwords. Why does String pose a threat to …

Read More