Good day. I have been tasked with implementing a SAML solution via CF. My production application servers are 2018 but I have access to an internal 2021 server ( with the new SAML tool ). Scenario: My org will be acting as the IDP and redirecting our users - which will be logged in via tradition login to our application - to a third party provider requiring SAML. The CF SAML docs appear to indicate that the process is initiated by calling an SSO url. I only need to send a SAML Response document to the SP. Can CF SAML generate a SAML Response document, which I can then post to the service provider, without the SSO workflow?

We had similar needs to you. We looked at Shibbolith, but it was overkill for what we needed. We ended up using the OneLogin Java SAML code with great success: https://github.com/SAML-Toolkits/java-saml The only issue we had was with the Auth.java class. Our SAML endpoints go through a re-write rule and I couldn't get the OneLogin code to play well with the rules, because it was seeing the re-written path, not the path the in the client. We sovled this by forking the code and adding a patch: https://github.com/SAML-Toolkits/java-saml/issues/198

Thanks for the response. The CTO is focusing on exhausting the use of the CF built in tool first - although I don't see the path with SSO there. I am still ramping up with SAML generally as it is new to me as well as the organization. I may loop back around to pick your brain a bit more. Thanks.

You can certainly reverse engineer all the Java code to CFML, but why spend the time and money? You're still going to use CFML to leverage the Java libs. You're just removing all the hard part.

I agree and I've leveraged other Java libraries, such as Twilio for SMS. Are you generating only an SAMLResponse document with this library with no other requisites? Are you also embedding certificate information?

I don’t think CF’s SAML implementation is intended to act as the IDP, it is intended to act as a SP. I think CF actually uses the java-saml library that @dswitzer mentions, I’ve also used that library directly (to act as a SP) and it works well for that purpose. If you really are intending to write a SAML IDP, you might want to pause and ask why are we doing that - the vast majority of organizations would rather rely on one that is already written and battle tested, such as Active Directory, Okta, Google, etc. Not saying there are not reasons to do so, but might be worth seeing if you already have one you can use if you haven’t done so already.

Thanks Pete. I suspected that this may be the case. The primary question now is where can I find the resources to implement the solution for our use case? Although I have decades of CF development experience, this is entirely new to me and my organization.

yeah, it’s complicated 🙂 but not so complicated that you couldn’t figure it out and get it working… the problem is there are a lot of things to consider/defend that’s why I suggested using one that is already built if possible. Is there some way you can connect / import your user db into something that supports SAML. For example can you setup an office 365 tennant or do you already have one? if so then it can handle authentication and provide saml through Azure AD

I'm with you on the 'complicated' aspect! I passed along your information and the response was "I understand why Pete F. would question this setup.. but we are in fact the Identity Provider (source) in this case." Unfortunately, this means I am no closer to a working solution.

yeah, I don’t know if you will find tons of info on implementing your own IDP… you might find this site handy to test your implementation: https://samltest.id/ I’ve used it to test a SP implementation and it was handy, but you can also use it to test an IDP… A good way to look at what you need to implement is to take a look at the IDP metadata file, here’s an example: https://samltest.id/saml/idp you can see that you have to publish some certificates, and you have to publish some URL endpoints for different purposes

Thanks Pete. I'll see if I can leverage the samtest.id site. The third party SP actually said the metadata file wasn't necessary as I would be providing a sample SAML. I'll see what I can come up with. These requirements or non-requirements as this case may be, makes this project more challenging!