Single Entry: Which direction should I go?

Question

I have a SaaS web application that serves several educational institutions. All clients are located in one application / database. The application is currently written in C # for ASP.Net 4 web forms.

Currently, my application uses a local / native database to authenticate / authorize users.

Our customers ask us to support single sign-on, where the client is an authentication provider and my consumer application.

The problem is that clients request SSO through various protocols / mechanisms such as Shibboleth and OpenID Connect. This means that I need - / must create a solution that works with all of these, or at least extensible.

I came across a Thinktecture IdentityServer, which I think can abstract the various single sign-on mechanisms used by my clients and return to my application the requirements-based identification token that my application understands.

I struggle a lot with this concept. Does this mean that my application redirects all authentication requests to IdentityServer, allows IdentityServer to process back and forth, for example, OpenID Connect, and then receives a token from IdentityServer with the information I need about the user? How does the authentication server know the scope of the user (i.e., it knows which client authentication provider should send the user)? Should IdentityServer check for a user in the local local application database? Can IdentityServer handle both SSO and local logins?

Is a separate authentication server a way? It looks like it will be, allowing my application to integrate with a single point (identity server). But there is not much documentation on the Thinktecture IdentityServer, but how to configure it. ADFS may provide a similar solution, but most of the examples there speak with ADFS and Azure.

Finally, I assume that I will still maintain local / native authorization data for each user, since the third-party authentication provider cannot know the specific authorization needs of my application.

Any thoughts or suggestions there?

Answer 1

Does this mean that my application redirects all authentication requests to IdentityServer, allows IdentityServer to process back and forth, for example, OpenID Connect, and then receives a token from IdentityServer with the information I need about the user?

I guess, yes. But it depends on how you configured it. Your page can call a client authentication provider if you have only one client or one authentication provider. Or you can configure a local IdentityServer (more extensible IMHO) and configure your client's authentication provider as another IdP (identity provider).

How does the authentication server know the user's domain (i.e. does it know which client authentication provider sends the user)?

If you go to the second option, your application will be redirected to IdentityServer and, based on the home world, it will be automatically redirected to IdP. If no home space is specified by your application, IdentityServer will show all configured IdPs, and the user chooses why IdP should be authenticated.

Does IdentityServer need to check for a user in a local or local application database?

It depends on you. If you want to check if a user exists in your local database, you can do this by extending IdentityServer.

Can IdentityServer handle both SSO and local logins?

Yes it is possible.

Is a separate authentication server a way? It looks like it will be, allowing my application to integrate with a single point (identity server).

You can always use IdentityServer and integrate it into your local application. Or you can use Shiboleth as a local authentication provider. Both implement standards such as WS-Federation, WS-Trust or OpenId, and both are open source, so you can extend / modify them to your liking.

But there is not much documentation on the ThinkTecture IdentityServer, except how to configure it.

I can’t say how much documentation there is. But if you want, NDC Oslo 2014 will present 2 days of pre-conference workshops where Dominic Bayer and Brock Allen (Authors of IdentityServer) will teach you everything you want to know.