Logging onto third-party system with SAML SSO

Question

I'm working to integrate my Sitecore 9.1.1 instance with a third-party service (an LMS) that uses SAML SSO. This is a one-way integration, where the front-end user logs into the site with the usual membership/roles system, and it then needs to log into the third-party service with SAML.

I've written some prior code for federated authentication, but that was for users logging into the Sitecore site, not for logging into another service. I don't know if the identity server comes into play here, but it doesn't appear to for the front-end, where I just use the standard Login method for signing people in.

What is the appropriate methodology here? Is it to call some API on the service's side to "shake hands" and sign in, passing the appropriate username and some token? Or do I need to generate some SAML package when the user logs into my site that's available when they click a link to take them to the service?

Answer 1

I believe what you are after is similar to what Sitecore have provided in the Docs "User bearer tokens in client applications"

You can leverage Sitecore Identity server as Federation Gateway for your Front Door website. Sitecore have also provided guidance how to register external providers and obtain a unique Sign In Url

You use the GetSignInUrlInfoPipeline pipeline and you want to get a sign-in URL for a particular subprovider to redirect users directly to the subprovider login page (skipping the SI login page). This link may be useful as well.

I would also suggest you have a look at the answer to this related question

Answer 2

There are several ways to achieve this. As mentioned before using the SI Federation Gateway can have benefits in certain scenarios for example when you have multiple sites which use this functionality. In this case the federation gateway can manage all the details for SAML SSO to the third party instead of each website.

If this is just a single site doing SAML SSO to a third party than it probably makes more sense to bypass SI and just do an IDP initiated SAML SSO to the third party, with Sitecore being the identity provider and the third party the service provider. There are some good libraries available to help with this for example ComponentSpace. These will help you save alot of development effort and will most likely be more secure than creating the SAML manually through Microsoft.IdentityModel.Tokens.Saml2