SAML 2 - Use Identity Server or implement directly in OWIN Middleware?

Question

I am thinking through a federated authentication approach requiring the use of a SAML 2 Identity Provider. The same Identity Provider infrastructure will be used for both the Sitecore admin and website authentication. It looks like the two options are...

1. Implement directly using ASP.NET Identity (OWIN Authentication middleware) introduced in Sitecore 9.0, widely referred to as "Federated Authentication" in the docs.

2. Use Identity Server as a federated gateway and create a custom plugin for the SAML 2 subprovider and deploy to the Identity Server Sitecore Host instance.

Implementing on top of the OWIN middleware looks to be more straightforward from an architecture and implementation perspective, any reason someone would caution against this route?

Answer 1

I wanted to share the implementation approach we landed on after research and discussion with folks at Sitecore and within the community.

1) For Sitecore Login, we will use Sitecore Identity as a Federation Gateway. We will write a SAML2 plugin for Sitecore Identity, relying on a third-party library to bootstrap this effort. Based on our research, Sitecore will continue to build functionality integrated with Sitecore Identity, and we felt this option provides the best chance at future-proofing the implementation.

2) For website login, we will make use of the OWIN Middleware offered through ASP.NET Identity. We will make use of a third party ASP.NET SAML2 implementation integrated with the OWIN Authentication middleware. We chose not to use Sitecore Identity for the website login because we are using a single Identity Provider, removing the benefit of putting Sitecore Identity in the middle between our client and the Identity Provider. Using Sitecore Identity for the website login would increase complexity by adding another hop in the authentication chain.