Do I need a federated Identity Server for SSO if I'm a small service provider application?

0
votes

Say I'm a small application (www.example.com) and I'm integrating with a much larger enterprise (www.acme.com).

In this scenario I am the service provider and they are the Identity provider.Their request is that I integrate into their auth ecosystem using SSO (specifically SAML 2.0).

For the standard IdP-initiated flow, users will sign in on their end and they will POST an XML assertion to my application, which will then verify the user and sign them in to my application (i.e. set a browser session).

The enterprise uses PingFederate as their identity server, and they are curious what implementation my application uses. At this time I have none.

  1. If my application is a single monolith (e.g. a small Ruby on Rails app), do I even need a federated server? Ultimately they are just looking for a place to POST SAML data to, so I can set up an endpoint and go from there right?

  2. What are some general benefits of a federated server? Why wouldn't every service provider application (small and large) just set up an endpoint to ingest SAML data and call it a day?

Thanks!

2
single-sign-onsamlpingfederate

2 Answers

1
votes

You don't necessarily need a Federation server. However, if you decide in the future to divide/expand your application into micro-services or integrate your service with other 3rd Parties, a server will allow you to scale without disrupting your current customers (great CX) and not have to manage separate security endpoints.

0
votes

  1. I think we should move this to software engineering

  2. How do users authenticate with your service? Having a federated identity guarantees that the whole user management process it's someone else's problem. They're looking for a way to integrate your service into their authentication system, so you need to set up an endpoint not only to consume but to be able to send SAML request to their identity server as well.

  3. I use my Google Account credentials to access almost all my social networking sites (including Stack Exchange), that means among other things that all sites know me as the same entity plus I just have to remember the one password.

  4. Don't know about SAML but almost everybody is using OpenId or OAuth.