search

SAML-Toolkits / python-saml

Python SAML Toolkit
MIT License
663 stars 305 forks source link

Question: What to do when OneLogin is SP + IP #156

Closed fingermark closed 8 years ago

fingermark commented 8 years ago

I have three applications that need to support Single Sign-on and we are looking into SAML. It'd probably be easiest to just use OneLogin as a Service Provider and Identity Provider -- this makes sense, right? All the demos I see are for creating a SP. If I use OneLogin as my SP + IP, then these applications wouldn't be SPs, right? How would I implement SSO via SAML using python-saml, then?

Thanks

pitbulk commented 8 years ago

Onelogin is able to act as an SP, in order to be connected with others Identity Providers, but at the end you will want to add SAML support to your 3 applications (build SPs) and connect it with Onelogin (IdP).

Possible scenario that Onelogin is able to manage:

Salesforce IdP   ----- Onelogin (as SP) | Onelogin (as IdP) ----- app1
          or                                         |------------app2
         ADFS                                        |------------app3

I recommend you to read how SAML works: https://github.com/jch/saml

fingermark commented 8 years ago

@pitbulk, that's an excellent resource. Thanks. So, after reading, it's fairly clear that app1, app2, and app3 would be SPs here.

In looking at the demo-django I was expecting a little more (in terms of user provisioning via create_user), didn't see the logic in the templates, and got confused to what an SP actually was.

Thanks for your help and your work. I'll likely be using this soon.

pitbulk commented 8 years ago

The demo-django is very basic and take care of the SAML stuff and shows how to use the toolkit, logic to provision the user and other stuff is a task of the developer that integrates the django application.

But if you are using Django as your framework, take a look at: