SAML
PingGateway implements SAML 2.0 to validate users and log them in to protected applications.
For more information about the SAML 2.0 standard, refer to RFC 7522. The following terms are used:
-
Identity Provider (IDP): The service that manages the user identity, for example PingOne Advanced Identity Cloud or AM.
-
Service Provider (SP): The service that a user wants to access. PingGateway acts as a SAML 2.0 SP for SSO, providing an interface to applications that don’t support SAML 2.0.
-
Circle of trust (CoT): An IDP and SP that participate in federation.
-
Fedlet: SAML configuration files.
SAML assertions
SAML assertions can be signed and encrypted. Use SHA-256 variants (rsa-sha256 or ecdsa-sha256).
SAML assertions can contain configurable attribute values, such as user meta-information or anything else provided by the IDP. The attributes of a SAML assertion can contain one or more values, made available as a list of strings. Even if an attribute contains a single value, it is made available as a list of strings.
SAML configuration
PingGateway scans SAML configuration files once, the first time that a request accesses the SamlFederationFilter or SamlFederationHandler (deprecated) after startup. Restart PingGateway after any change to the SAML configuration files.
SAML in deployments with multiple instances of PingGateway
When PingGateway acts as a SAML service provider, session information is stored in the fedlet not the session cookie. In deployments with multiple instances of PingGateway as a SAML service provider, it is necessary to set up sticky sessions so that requests always hit the instance where the SAML interaction was started.
For information, refer to Session state considerations in AM’s SAML v2.0 guide.
About SP-initiated SSO
SP-initiated single sign-on (SSO) occurs when a user attempts to access a protected application directly through the service provider (SP). Because the user’s federated identity is managed by the identity provider (IdP), the SP sends a SAML authentication request to the IdP. After the IdP authenticates the user, it provides the SP with a SAML assertion for the user.
For the SamlFederationFilter, prefer SP-initiated SSO to IdP-initiated SSO:
-
A dedicated SAML URI is not required to start SP-initiated authentication.
-
The HTTP session tracks the state of the user session.
The following sequence diagram shows the flow of information in SP-initiated SSO when PingGateway acts as a SAML 2.0 SP:
Federation using the SamlFederationHandler (deprecated)
| The SamlFederationHandler is deprecated. Use the SamlFederationFilter instead. |