Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Single Sign-on at Rackspace

medium.com

Post reply on HN
Print view View original

1–10 of 10 posts

Re: Single Sign-on at Rackspace

#2

Post by Rapzid »

How are you guys finding the tools for supporting SAML SSO? I only recently had to stare into the abyss and found it to be a rather abysmal(harhar) experience.

One of the most popular service providers, Shibboleth, was a PITA to get setup the first time. Terribly complicated to get going from ZERO to signed in with ADFS as the ident provider. Options available for distribution and clustering are not up with the times. Only supported SHA1 hashing. Etc, etc. I know the guys put a lot of effort in on it and are pretty helpful on list but... I can't help but feel that 2014 deserves a better SSO experience :|

Re: Single Sign-on at Rackspace

#3

Post by dylz »

Out of curiosity, what was the reasoning in using saml/idp/xml/etc? Java shop + enterpriseyness?

I don't know a single person that enjoyed dealing with SAML SSO (myself included, using shib)

Re: Single Sign-on at Rackspace

#4

Post by anton_gogolev »

dylz wrote: post #3

Out of curiosity, what was the reasoning in using saml/idp/xml/etc? Java shop + enterpriseyness? I don't know a single person that enjoyed dealing with SAML SSO (myself included, using shib)

Care to share the most... er... painful painpoints? We're about to embark on a journey of implementing a SSO solution and are evaluating Windows Identity Foundation.

Re: Single Sign-on at Rackspace

#6

Post by taspeotis »

anton_gogolev wrote: post #4
dylz wrote: post #3

Out of curiosity, what was the reasoning in using saml/idp/xml/etc? Java shop + enterpriseyness? I don't know a single person that enjoyed dealing with SAML SSO (myself included, using shib)

Care to share the most... er... painful painpoints? We're about to embark on a journey of implementing a SSO solution and are evaluating Windows Identity Foundation.

I've just finished implementing SSO with WS-Fed and WIF. The code samples are the documentation.

Re: Single Sign-on at Rackspace

#7

Post by alexmeng »

Rapzid wrote: post #2

How are you guys finding the tools for supporting SAML SSO? I only recently had to stare into the abyss and found it to be a rather abysmal(harhar) experience. One of the most popular service providers, Shibboleth, was a PITA to get setup the first time. Terribly complicated to get going from ZERO to signed in with ADFS as the ident provider. Options available for distribution and clustering are not up with the times…

I can't speak for the services out there. We built on top of open source libraries to roll our own solution. The protocol is actually pretty straight-forward to implement.

Re: Single Sign-on at Rackspace

#8

Post by alexmeng »

dylz wrote: post #3

Out of curiosity, what was the reasoning in using saml/idp/xml/etc? Java shop + enterpriseyness? I don't know a single person that enjoyed dealing with SAML SSO (myself included, using shib)

We went with SAML mainly because of the standardization. A lot of different technologies are in use at Rackspace because teams are given a lot of autonomy. There are open source SAML libraries out there for pretty much any language, so having another team hook into our SSO solution isn't too difficult.

Re: Single Sign-on at Rackspace

#9

Post by pmahoney »

Rapzid wrote: post #2

How are you guys finding the tools for supporting SAML SSO? I only recently had to stare into the abyss and found it to be a rather abysmal(harhar) experience. One of the most popular service providers, Shibboleth, was a PITA to get setup the first time. Terribly complicated to get going from ZERO to signed in with ADFS as the ident provider. Options available for distribution and clustering are not up with the times…

I found the tools weak at best, confusing and overcomplicated at worst. The code from OneLogin [1] was the clearest example I found, but it leaves various things as an exercise for the reader, such as obtaining the relevant public key and establishing trust in that key.

I ended up doing a lot of custom stuff that is highly specific to the particular SAML implementation in use at my company. For example, the public signing key is included with the SAML response (on successful sign on) as an x509 certificate. I extract if from there and establish trust by verifying the signature chain (up to the root SSL certs included in my distro). But, SAML also allows embedding raw RSA or DSA keys, or presumably none at all (and you'd store the trusted key somewhere as a configuration value). So I don't support "SAML" but "the specific SAML implementation currently in use at my company".

But I've worked closely with an OAuth client before as well, and in the end I'd say they are roughly equivalent in terms of ease of use, but there was a larger learning curve for SAML (and XML-DSig is frustrating due to whitespace sensitivity among other things. Implementation seems like a huge burden if your language lacks it).

[1] https://github.com/onelogin/java-saml But see other language impls. as well

Post reply on HN