Samly - Add SAML SSO to your Phoenix application (now with multiple identity provider support)

Samly library version v0.8.0 introduces support for working with multiple Identity Providers (earlier versions were limited to working with only one IdP).

There are two companion Repos:

• samly_simplesaml - Docker based self-hosted SimpleSAMLPhp Identity provider for development purposes
• samly_howto - A simple Phoenix application that demonstrates how to SAML enable your application. This will show the SAML assertions from the IdP upon success end-user authentication. It is mostly pre-configured to work with samly_simplesaml. But you can change the configuration to point to any SAML provider.

The Samly documentation has been updated as well.

https://github.com/handnot2/samly

https://github.com/handnot2/samly_howto

https://github.com/handnot2/samly_simplesaml

Samly v0.8.4 and esaml v3.3.0

Now works with Shibboleth IdP (in addition to SimpleSAMLPhp). Here are some screenshots showing the login and consent flows interacting with a self-hosted Shibboleth IdP setup.

Login portion in a Samly enabled phoenix app

Shibboleth Login Page

image.png359×462 30.6 KB

Shibboleth Consent Page

image.png611×601 70.7 KB

Back to the Phoenix app - Showing the SAML assertion Attributes

image.png710×381 25.1 KB

@handnot2 Thank you for your work as part of the Samly library. I’m curious, how easy would it be for one to integrate this with Coherence or Guardian . Do you have any thoughts on that or any open source projects where you’ve tried out this kind of an integration ?

Samly is used to enable SAML authentication in your application talking to a SAML provider. Such SAML providers typically would include the capabilities that Coherance provides. Lot of Universites use Shibboleth as their SAML provider and they already would have the user registration, password recovery, notification etc built-in or integrated. The same goes for cloud systems such as OneLogin, Azure and many internal corporate Identity systems. My understanding is that you would need Coherence when you want to manage these capabilities in your application itself. If that is your requirement, you probably don’t want SAML.

If your question is more about how easy it is to integrate Samly in your application, check out the README file. It is very easy. The usual hickups are related to making sure you have the correct SAML provider endpoint information, certificates, whether signing/encryption are used or not and making sure that the config settings are correct.

As a recommended practice, one should clone the following How-to repo, make config changes in that repo (dev.exs) pointing to the SAML provider you want to work with and make sure you are able to login/logout and get the SAML assertions correct. All this without making any other code changes.

https://github.com/handnot2/samly_howto

The screenshots shown earlier were from this samly_howto Phoenix app. Once this works, make the minimal changes required in your own Phoenix app with the config settings you had success with. You will have a better integration experience if you follow this model.

Hope this helps.

Hi @handnot2,

Thank you for your response.

I will look at Coherence in some more detail from my end to confirm if this is a SAML provider. I’m relatively new to SAML but will definitely explore further to understand it’s concepts better.

We’re trying to implement a Unified login service at our company currently. My requirement at a high level as part of this is to use the capabilities that Coherence provides, add Social sign in capabilities(planning to use - GitHub - danschultzer/coherence_assent: UNMAINTAINED - Add multi provider login to your Coherence Phoenix website · GitHub for Google and FB login) and also implement SSO(via Samly) in addition to this.

One of the use cases where SSO can be useful is, if a user is logged in to one app, we want that user to be auto logged in to the other app(both apps should be somehow tied to the same unified login service). That’s basically why we need SSO. At a high level, when we implement Social Sign in, We want the call back URL from a Provider like FB or Google to go to our authentication service(the unified login) which would return a session token to help keep the user signed in across multiple apps.

This is basically why I wanted to get more clarity on what do you think could be the feasibility of having all of this together in one application. Would it be possible for you to throw more light on whether one can potentially have all these capabilities in one application from your knowledge and experience?

I will also work towards following up on the above from my end.

Thank you for your time!

Does anyone need instructions on how to setup a self-hosted Shibboleth Identity Provider installation (development setup) for use with Samly?

This would be similar to the samly_simplesaml - but pointing to an LDAP store for user authentication.

Created a blog post on using samly. This includes instructions on setting up a self-hosted Shibboleth SAML Identity Provider that uses OpenLDAP.

Samly V0.9.0 - IDP Initiated Login (aka IDP-First flow)

The authentication flow can now be started from an IDP. For example, cloud hosted SAML authentication providers such as OneLogin allow your application to be registered and be shown on an application portal/dashboard. The end user can login to the application portal click on your application Icon and be redirected/taken to your application.

Samly already supports the SP initiated login flow. In this model, the end user visits your application pages first. The login flow is initiated in your application, user authenticates and gets redirected back to your app.

Based on how your IDP is setup, you can get the user profile information along with any assigned “roles” in the SAML assertion. These are made available for you in the Plug/Phoenix connection. You can use any plug based authorization system to perform authorizations.

FYI. Samly is known to work with SimpleSAMLPhp, Shibboleth, OneLogin and other SAML 2.0 providers. If you work with other SAML providers, use the documentation and the blog entry above to do your own integration. Please share if you are able to integrate Samly with other SAML providers.

Really impressed how you’re bringing Samly along. I have a project coming up that will absolutely benefit from your work. Part of that will be doing some work to integrate with SAP’s IDP. Thanks for the effort!

Hope this can evolve to work with more providers. When you are ready, let us know how it goes with SAP IDP. Thanks.