AWS Single Sign-On

Re:AWS Single Sign-On by ak217 on Wednesday December 13, 2017 @12:53PM (#15915928)

Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC?

Are there implementation notes or library implementations of SAML and OIDC that you would recommend as good references? I'm aware of Okta's docs, https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet, https://wiki.mozilla.org/Security/Guidelines/OpenID_Connect, and the Google docs you linked, but would like to learn more/find better libraries.

[ Parent | on HN ]

Re:AWS Single Sign-On by lvh on Wednesday December 13, 2017 @01:01PM (#15915998)

Sorry for the term confusion: TinySAML is what I’m informally calling the tiny subset of SAML we’re choosing to care about. Neither full-SAML nor full-OIDC fit in my head; I’ll also concede that full-SAML is much more complicated than full-OIDC, but that doesn’t matter: narrowing scope is much more effective for SAML than OIDC.

I hope both protocols become obsolete. SAML may not be the future, but it’s definitely the present. I’m not convinced OIDC is materially better.

‘tptacek will have much more informed opinions about relative SAML library quality so I’ll leave that to him.

[ Parent | on HN ]

Re:AWS Single Sign-On by tptacek on Wednesday December 13, 2017 @01:11PM (#15916100)

The actual Go package is "trivialsaml". :)

[ Parent | on HN ]

Re:AWS Single Sign-On by ak217 on Wednesday December 13, 2017 @04:46PM (#15917967)

Would be interested to see the source (for reference purposes only, anyway - I prefer Python myself) or any other resources you recommend.

[ Parent | on HN ]

Re:AWS Single Sign-On by tptacek on Thursday December 14, 2017 @09:24AM (#15922410)

It'll all be public in a few weeks.

[ Parent | on HN ]

Re:AWS Single Sign-On by tptacek on Wednesday December 13, 2017 @01:00PM (#15915994)

I hope both SAML and OIDC go away.

[ Parent | on HN ]

Re:AWS Single Sign-On by ak217 on Wednesday December 13, 2017 @01:01PM (#15916001)

And are replaced with what?

[ Parent | on HN ]

Re:AWS Single Sign-On by lvh on Wednesday December 13, 2017 @01:07PM (#15916061)

We don’t think it’s been written yet. But punchline: don’t support every combination of encryption and signing; sign in 1 place and 1 place only, tiny set of protocol versions...

[ Parent | on HN ]