handnot2 / samly

Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications.
MIT License
125 stars 90 forks source link

Allow receiving raw XML metadadata with IDP config #37

Open hodak opened 5 years ago

hodak commented 5 years ago

Hi, we have a case where we store IdPs in database, instead of config file. It allows us to store metadata with a db record.

handnot2 commented 5 years ago

Do you have the need to add IdP provider dynamically? There is an issue related to that: #29.

hodak commented 5 years ago

Yes, that is our use case

handnot2 commented 5 years ago

I am planning to get to these PRs once the v1.0 release is out. Thanks for your patience.

hodak commented 5 years ago

No problem, at the time we're using fork. Thank you ;)

hodak commented 5 years ago

@handnot2 I have fixed conflicts with current master

freevova commented 4 years ago

@hodak Great work. I would like to use this code too. @handnot2 Is it possible to merge this PR?

messutied commented 4 years ago

Hi @hodak, may I ask how do you use this for your use case? (load IdP from DB) do you use a completely separate flow? meaning that you do not use the provided Samly plugs, store, etc, and instead roll your own consumer action and use the underlaying modules of Samly there?

Looking into how to load IdP from DB myself :)

hodak commented 4 years ago

@messutied No, we pretty much use everything as-is, we just have a GenServer worker in our supervision tree (so it's called right after app boots), that does something like this:

  defp do_perform do
    idps =
      query_active_idps_from_db()
      |> Enum.map(fn idp ->
        Map.merge(default_opts, %{
          id: idp.subdomain,
          metadata: idp.metadata_xml,
          sp_id: idp.entity_id
        })
      end)

    new_env =
      Application.get_env(:samly, Samly.Provider, []) |> Keyword.put(:identity_providers, idps)

    Application.put_env(:samly, Samly.Provider, new_env)
    Samly.Provider.refresh_providers()
  end

and we have a way to trigger this refresh after identity provider changes in the database.

Remember that if you have multiple nodes, you must call the refresh on each one of them. This PR is also relevant: https://github.com/handnot2/samly/pull/38

messutied commented 4 years ago

Thanks a lot @hodak! very helpful.