Single Sign On: SimpleSAMLPhp Service Provider Implementatio

Question

I am implementing a SSO using SimpleSAMLPhp Service Provider.

I provided my metadata to remote Shibboleth Identity Provider and was provided a test account.

When a user visits a specific page on my SP, they get redirected to the IdP, login, and are redirected back to my web site with a bunch of IdP provided attributes. This part works.

This part I am struggling with.

If the user authenticates with the same IdP through a different Service Provider and then visits my page, how do I know they are already authenticated? Currently I am being asked to login again.

Is there a configuration value somewhere that lets me do this? Or am I using the wrong method? This is what I am doing.

$as = new SimpleSAML_Auth_Simple({REMOTE_AUTHSOURCE});
$as->requireAuth(); // this redirects to remote IdP login
$attributes = $as->getAttributes();

Thanks.

Patrick Patrick · Accepted Answer · 2017-03-13T16:23:16

There are two separate authentication sessions to consider. One session is in you app and the other is at the IdP. The requireAuth method can tell if the user already has an authenticated session in your application, and will return immediately in that case. There is no way for you to tell if a browser has a session at the IdP. You just call requireAuth whichs send the user there and if the IdP decides the user's session is still valid it will respond without prompting for login.

Are you saying that the user has a valid session at the IdP and they are being re-prompted to authenticate when you send the user there? That could be due to IdP policy, or if your app was sending something like 'forceAuth' in its AuthnRequest.

Single Sign On: SimpleSAMLPhp Service Provider Implementatio

1 Answers