Mapping SP metadata into FusionAuth IDP setup

[prasanna10021991]

In continuation of the conversation over the other thread: https://github.com/FusionAuth/fusionauth-issues/issues/240 I'm starting a new thread here @robotdan ,

Thank you so much for the prompt response. I understand the bit of importing the SP's certificate in Key Master. But I'm still not able to link it in the IDP Application where the test SP setup is available.

I might have confused earlier while mentioning I'm trying to set up IDP. Actually trying to configure fusion-auth itself as the Identity-Provider for a SSO setup that will integrate with multiple systems by following the steps mentioned here: https://fusionauth.io/docs/v1/tech/samlv2/overview

I'm able to get the application set up with the Issuer and ACS info from SP. But I couldn't link the signing key imported from the SP or upload SP's metadata separately anywhere. Getting confused on the complete flow here in creating a fusion-auth IDP and linking it with a SP.

Test SP's used: https://samltest.id/start-idp-test/ https://sptest.iamshowcase.com/authnrequest

I've done all the steps mentioned in the above guide, as well as created an user and set email as the authentication attribute for the SAML setup. Still ending up on a 500 error, and the logs only show a null pointer exception.

Could you please help me figure out the setup process here.

[robotdan]

@prasanna10021991 can you re-test this on the latest 1.8.0 RC version and let me know if it is still failing?

https://fusionauth.io/docs/v1/tech/release-notes/

[prasanna10021991]

Sure will test post update and let you know, Thanks @robotdan .

Meanwhile, another clarification that I wanted to check with away from this topic, FusionAuth has set up a page for SAML v2 integration doc for Zendesk and currently shows as coming soon. Would you be kind to let me know any timeline status that you're aware of on that, because we are trying to build a system that requires SSO with zendesk and few other applications. So was hoping to get an idea on that if I could.

[robotdan]

@prasanna10021991 thanks!

Re: Zendesk

Yeah, we have been so swamped.. we haven't gotten back to those docs. We have tested with Zendesk and have performed an integration, so we know that it works. If you need to get that integration working and the tutorial isn't there yet open a GitHub issue or join the Slack channel and we can point you in the right direction.

[prasanna10021991]

@robotdan ...Thank you,

I'll open a github thread on that separately. I've been able to get the IDP working and was successfully able to test using the samtest.id. When I trigger a saml authentication request I'm able to successfully get the email id used to login into the idp application. I have few questions though now on real implementation setup.

I've tried out the fusion-angular-sample proj which partially has the setup for login/authenticate flows. My next steps on this would be to figure out how the flow work for an IDP initiated SSO, because the project setup will have a login which authenticates to fusionauth and have to redirect to different applications from the main portal wherein the sso will have to be initiated by the idp. Could you please shed some light on this if possible. Thanks for the support.

[prasanna10021991]

Hi @robotdan , I've submitted a feature request for updating the Zendesk SAML integration doc here: https://github.com/FusionAuth/fusionauth-issues/issues/287

Any help on this issue and the previously mentioned IDP initiated SSO setup is much appreciated. Thanks a ton.

[prasanna10021991]

@robotdan ..On a separate note, wanted clarification on another item. Is FusionAuth-IDP set by default to forward any RelayState Parameter sent by an SP automatically, or an external/additional process has to be utilized to modify the SAML response sent by IDP.

[robotdan]

Is FusionAuth-IDP set by default to forward any RelayState Parameter sent by an SP automatically

Yes, I believe any RelayState you provide will be sent back in the POST request.

[prasanna10021991]

Awesome, Thanks @robotdan .

[robotdan]

Can I close this issue out, or was there additional issues still not addressed here?

[prasanna10021991]

Sure @robotdan 👍 💯 no further issues on this :)