Guideline for Service Owners

We provide you with the flexibility to connect your services to our IdP solutions through two protocols: SAML and OIDC. These protocols ensure a secure and smooth integration, allowing for seamless authentication and authorization processes for your applications.

SAML allows for secure single sign-on (SSO) and federation across different applications and platforms. It enables the exchange of user authentication and authorization information in a standardized way, ensuring smooth communication between your services and our IdPs.

SimpleSAMLphp (https://simplesamlphp.org) is an open-source software package for providing IAM functionalities and features. It is written in PHP and supports straightforward integration of new customizable modules. SimpleSAMLphp is often used to provide authentication and authorization services for web-based applications; however, it also supports native mobile apps and APIs using different protocols, including SAML, OIDC, and OAuth. It is designed to be easy to install and configure and can be used as a standalone application or as a module within other applications.

Shibboleth (https://www.shibboleth.net) is a type of open-source SAML implementation developed by the Shibboleth Consortium. It provides content personalization, secure authentication, and authorization and enables SSO functionality for accessing services in multiple domains. Shibboleth has been designed to be compatible with many organizational domains' infrastructures to support general FIM requirements.

To connect your services to our SAML SSO solution, we request the following information from you:

• SP Metadata (Mandatory): Provide us with the metadata of your service, which typically includes information about your organization, entity ID, and SAML endpoints.
• Authorization Policies (Optional): Provide us with the information and conditions on whom and how they can access your services. Example: Only students from the University “ABC” are authorized to access our resources.

Once you have collected this information, please submit it to our support team at sso-support@gwdg.de.

We will provide you with the necessary SAML metadata, which is an XML document containing important configuration details about the IdP you requested to connect. The metadata includes information such as URLs of endpoints, supported bindings, identifiers, and public keys. Depending on your application framework or platform, you will need to locate the appropriate configuration file or settings where you can specify the IdP's metadata. This step ensures that your application recognizes and trusts our IdP. If your application doesn't have built-in SAML support, you can leverage external libraries specifically designed for SAML communication. These libraries provide pre-built functionalities and utilities for SAML authentication, simplifying the integration process. Choose a library that suits your programming language and framework.Please note that the specific implementation details may vary depending on your application framework, platform, and the chosen library. It is recommended to consult the documentation and resources specific to your application or chosen library for detailed instructions. After completing the configuration, thoroughly test the integration by initiating SSO requests and validating the SAML responses. Ensure that the authentication flow is seamless and that user attributes and assertions are correctly processed.

In addition to SAML, we support OIDC as an alternative protocol for integrating your services with our IdPs. OIDC is an identity layer built on top of the OAuth 2.0 framework. It extends the OAuth 2.0 authorization protocol to provide an additional authentication protocol. OIDC allows third-party applications to verify the identity of end-users and obtain basic user profile information. It uses JSON web tokens (JWTs) to exchange information between the client application and the OpenID Provider (OP).

Keycloak is a Red Hat-sponsored IAM solution supporting multiple protocols. Some important technologies and features supported by this open-source solution are:

• Extensible Customization: Keycloak allows for developing customizing IdM and AM solutions with minimum coding and straightforward deployment.
• Delegated Authentication: Keycloak can be configured to be connected to external IdPs supporting OIDC or SAML 2.0 protocols. In other words, user authentication can be managed through the Keycloak or external IdPs.
• Delegated IdM: Keycloak supports the management of user identities and admin access centrally. However, it also offers an easy solution for connecting to user directories such as Active Directory and LDAP that currently exist in a domain.
• Customized AM Mechanisms: Keycloak supports various AM mechanisms, including MFA, one-time password (OTP), and customized policies. Service owners can also request a combination of these mechanisms to authenticate and authorize users.

To connect your services to our OIDC solution, we require the following information from you:

• Base URIs (Mandatory): Provide the base URIs for your application. These URIs represent the main endpoints of your application where authentication and authorization will take place.
• Redirect URIs (Mandatory): Specify the redirect URIs that will be used for the authentication flow. After successful authentication, users will be redirected to these URIs with the required authorization code or access token.
• Scopes (Optional): Specify the scopes required for accessing user information. Scopes define the permissions and level of access your application needs, such as openid, profile, email, or custom scopes specific to your application.
• Authorization Flow (Optional): You have the flexibility to choose the desired authorization flow for your application. OIDC supports various flows, such as the Authorization Code Flow, Implicit Flow, and Hybrid Flow. Each flow has its own characteristics and security considerations. Select the appropriate flow based on your application's requirements.
• Authorization Policies (Optional): Refer to SAML.

Once you submit the required information, we will provide you with the necessary OIDC configuration details, including the client ID, client secret, authorization endpoint, token endpoint, and other relevant parameters. These details will enable you to configure your application and communicate with our OIDC provider. Similar to the SAML connection, if your application doesn't have built-in support for OIDC, you can incorporate an OIDC client library or SDK suitable for your programming language and framework. Please ensure that you follow the configuration steps carefully, handle received tokens securely within your application, and adhere to best practices for OIDC implementation.

When considering whether to choose SAML or OIDC for integrating your services with our IdM or IdP solutions, it's essential to evaluate the specific benefits each protocol offers. Here are some key arguments to help you make an informed decision:

• You need modern authentication and authorization features: OIDC builds upon OAuth 2.0 and offers additional features for modern identity management, including support for mobile and web applications, enhanced security, and flexible authorization mechanisms.
• Simplicity and ease of implementation: OIDC is often considered simpler to implement compared to SAML, making it a favorable choice if you prioritize ease of integration and maintenance.
• Industry adoption and compatibility: SAML has been widely adopted for many years and is well-established in various industries, making it a reliable choice for compatibility with existing systems and integration with partners or service providers who predominantly support SAML. If your organization operates in an industry where SAML is prevalent and requires seamless interoperability with other entities, choosing SAML can ensure smoother collaboration and integration.
• Compliance and regulatory considerations: Depending on your industry or jurisdiction, specific compliance or regulatory requirements may influence your choice of protocol. Some industries or regions have specific guidelines or regulations that dictate the use of certain protocols.

Ultimately, the best choice depends on factors such as your existing infrastructure, compatibility requirements, and specific use cases. If you are unsure which protocol is the most suitable for your needs, we recommend consulting with our team. We can assist you in assessing your application's specific requirements and guide you in making an informed decision.