search

seknox / trasa

Zero Trust Service Access
https://www.trasa.io
Mozilla Public License 2.0
382 stars 71 forks source link

[FEATURE] Add more user identity and SSO providers. #122

Open flyinghermit opened 4 years ago

flyinghermit commented 4 years ago

Describe the feature:

TRASA currently only supports LDAP (Open ldap, freeIPA, Active Directory) and SAML (Okta) as identity providers. This feature request is to integrate with more IDPs such as G suite, JumpCloud, Office365, and other popular solutions.

Scope of feature:

flyinghermit commented 4 years ago

I am working on this feature.

For implementation reference, there are some questions that we need to answer before we implement this:

  1. Almost every Identity providers support both SAML and OIDC (or OAuth2 variant) integration. So which implementation should we target for integrations?

  2. There are many IDPs; which one should we support for this milestone?

To officially support IDP with TRASA, here is what I vote for:

  1. If the Identity Provider supports SAML, we will support SAML integration because this is a defacto protocol that many IDP priortize.
  2. I have these IDPs in mind:
    • [x] Okta
    • [ ] G suite
    • [ ] OneLogin
    • [ ] Ping Identity
    • [ ] Microsoft Cloud IDP (Office 365, Azure AD)
    • [ ] Jumpcloud

Note: Once we implement, generic SAML or OIDC interface, it will actually work with any IDP that supports those protocols unless some quirky gotchas prevent it.

zPhilMc commented 3 years ago

I would love to see and option that will work with O365/AzureAD as an identity provider.

mprajescu commented 3 years ago

I would like to see it work with Keycloak as well. Is there any progress on the generic OIDC/SAML interface?