Simple IDP for SAML

Question

We maintain a website that uses the built-in .NET Core / EF Identity model so all user data is in DB tables. We now have a need to support SSO into another 3rd party system which requires that we host our own IDP with support of SAML 2.0. We don't want to change our identity model or login process for our own website, we just need to return a SAML Response for a user without our website as a response to an SSO request by the 3rd party website. Our site is hosted in Azure as a Web App but we don't use Azure AD for this website which is public facing for external client employees.

Are there any recommendations to create a simple IDP that maps to our existing AspNetUsers database table to retrieve and prepare an SSO Response but doesn't impact our existing identity setup? In all likelihood, we'll have to support other SSO protocols in the future with the same implementation. Do we need to go as far as to implement IdentityServer4, making the existing web app act as both an IDP and a client app?

Answer 1

idsrv4 supports the EF identity model (AFAIK). If it doesn't you could always write your own plugin.

idsrv4 then becomes the IDP and will authenticate against your current DB.

idsrv4 has SAML and WS-Fed plugins to support future SSO.

Your other choice is to implement something like Auth0 that supports authentication against local DB and has full support for SAML and WS-Fed.