OpenSAML user discussion

["Pantvaidya, Vishwajit" <>]

Hello,

 

Just started looking at SAML – so please pardon the very basic questions. But I need to achieve SSO using SAML for the following flow:

 

-          user comes to our website but is redirected to a login page at a remote authenticating webserver

-          user enters logon userid/pwd

-          remote webserver authenticates and assembles a SAML assertion

-          servlet appends SAML assertion and redirects the request through browser to our website

-          we process the request and allow user access to our resources if SAML assertion shows successful authentication

So basically looks like in our case the SAML assertion xml will be passed through the URL parameters.

 

I checked SAML 1.1 and 2.0 specs and it seems that 1.1 does not support this scenario. So

- do I need to use SAML2.0 (it seems the SAML2 HTTPRedirect binding will fit this usecase)?

- in that case, should I download the OpenSAML 2.0 source from https://projects.middleware.georgetown.edu/viewcvs/java-opensaml2/trunk/, build it and use it that way

 

Any other suggestions welcome.

 

 

Thanks,

 

Vish.