Thanks!
I’ll make sure to post any insights here for the community 
scoop
adamverb
fyi you can set up Samly SSO with Azure AD SSO (Microsoft Entra). however i first set up locally got it working with simplesamlphp, then moved to staging environment and got it working with simplesamlphp as its just easier for me as i’ve used it before. then after i got that working fine i set up Azure AD which is Entra now. Took me roughly 2 days to get it fully working with signing/encryption at that point. i suggest doing this yourself instead of with a client as lots of iteration was needed for my goals, mostly due to a single Samly setting.
i started with this. i wanted store to be session instead of ETS and i used a custom key, you can use the key to delete the session to help logout (default key is “samly_assertion”)
config :samly, Samly.State,
store: Samly.State.Session,
opts: [key: "custom_key_here"]
can use key like this to delete from session
|> delete_session(:samly_assertion)
|> Guardian.Plug.sign_out()
as for rest of samly settings pretty simple honestly cept for signed_envelopes_in_resp if you want to use encryption on Azure, that needs to be false or you get :bad_digest error. but here is what i have, most are env vars for me but i’ll change for here to make simpler.
config :samly, Samly.Provider,
idp_id_from: :path_segment,
service_providers: [
%{
id: "sp1",
entity_id: "urn:myapp.com:samly_sp",
certfile: "/app/saml_sp_cert_file.pem",
keyfile: "/app/saml_sp_key_file.pem",
contact_name: "Administrator",
contact_email: "myemail@mycompany.com,
org_name: "mycompany",
org_displayname: "mycompany",
org_url: "https://myapp.com"
}
],
identity_providers: [
%{
id: "idp1",
sp_id: "sp1",
base_url: "https://myapp.com/sso",
metadata_file: "/app/lib/my_app-1.0.0/priv/metadata/idp_metadata_azure_testing.xml",
allow_idp_initiated_flow: false,
use_redirect_for_req: false,
sign_requests: true,
sign_metadata: true,
signed_assertion_in_resp: true,
signed_envelopes_in_resp: false
}
]
on the Azure (Entra) side wanna be here https://entra.microsoft.com/.
Identifier (Entity ID) = entity_id from sp1
Reply URL (Assertion Consumer Service URL) = https://myapp.com/sso/sp/consume/idp1
then in SAML Certificates set Signing Option to sign both response and assertion. this is how i wanted it, there is no option for neither, so not sure if that’s possible or not.
then in Token encryption upload your public cert if you want to enable encryption, if the status is Active then encryption is on if its Inactive then encryption is off. on the Samly side there is no turning encryption on/off thats just on the Entra side by this Active/Inactive cert.
NOTE: Obviously change anything you want also change all my app/company specific stuff.
NOTE2: There are a few more IDP settings which i don’t have here since i didn’t need them, but check out GitHub - dropbox/samly: Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications. · GitHub for them all.
NOTE3: I left out some minor stuff like attribute claims and code implementation for logout/in as that should be pretty straight forward, if your attempting this.
2