Angularjs和SAML，一开始 [英] Angularjs and SAML, the beginning
问题描述
我正在开发一个需要SAML来管理OpenAM服务器身份验证的应用程序。
I m working on an application that needs SAML to manage authentication with an OpenAM server.
实际上，我使用带有OAuth2隐式授权流的Satellizer，我有以下内容：
Actually, I use Satellizer with OAuth2 implicit grant flow and I have the following :
- 在浏览器中打开angularjs应用程序
- 点击第三方登录按钮
- 新窗口悬停现有的（使用ng app）已打开，询问我的凭据
- 我填写它们并验证
- 页面制作了它的东西（生成令牌）
- angularjs应用程序通过窗口获取令牌（如何实现？）
- 我可以将我的应用程序与OAuth2 bearer / jwt令牌一起使用。
- Open angularjs app in browser
- Click on the third party login button
- A new window hover the existing one (with ng app) is open asking me my credentials
- I fill them, and validate
- The pages made its stuff (generating token)
- The angularjs application gets the token through the windows (how it is possible ?)
- I can use my application with the OAuth2 bearer / jwt token.
我需要有一些有用的东西同样使用SAML。事实是，我完全迷失了，似乎我应该使用我的后端登录SAML服务器......
I need to have something that works the same using SAML. The fact is that I m completely lost and it seems that I should log onto the SAML server using my backend...
我真的不喜欢这种情况而且我需要知道使用客户端应用程序是否有更好的事情。
I don't really like this situation and I need to know if there's something better to do using client side application.
客户端应用程序与SAML的通常身份验证流程是什么？
What is the "usual" authentication flow with client side app with SAML ?
感谢您的帮助
推荐答案
SAML2是在客户端的概念设计的尚未发明使用JavaScript的应用程序。
SAML2 was designed at a time when the concept of client side apps with JavaScript was not yet invented.
一种常见的方法是使用中间OpenID Connect / SAML2代理/网桥（例如IdentityServer3 + Kentor.AuthServices.Owin）进行身份验证用户：
A common method is to use an intermediate OpenID Connect/SAML2 proxy/bridge (e.g. IdentityServer3 + Kentor.AuthServices.Owin) to authenticate users:
- 用户在JS应用程序中开始登录。
- 用户被重定向（部分OpenID Connect流程）到IdentityServer3。
- 将用户重定向（SAML2P的一部分）到SAML2 Idp。
- 用户在SAML2 Idp进行身份验证。
- 用户被重定向到ba ck到IdentityServer3（SAML2P的一部分）。
- 用户被重定向回JS app（OpenID Connect流程的一部分）。
- User starts log in sequence in JS app.
- User is redirected (part of OpenID Connect flow) to IdentityServer3.
- User is redirected (part of SAML2P) to SAML2 Idp.
- User authenticates at SAML2 Idp.
- User is redirected back to IdentityServer3 (part of SAML2P).
- User is redirected back to JS app (part of OpenID Connect flow).
这非常适合用户使用外部Idp进行身份验证。如果您有资源，例如后端服务，那么这些呼叫通常是通过在步骤6发出的OAuth2持票人令牌授权的。
This works excellent to get the user authenticated with an external Idp. If you have resources, such as backend services, those calls are usually authorized through an OAuth2 bearer token issued at step 6.
如果您的后端API期待SAML断言而不是不过你将不得不看看我们的方式。
If your backend API is expecting a SAML assertion instead of a bearer token you will have to look at our ways though.
这篇关于Angularjs和SAML，一开始的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
