Implement dotnet core Identity Provider server for Google
up vote
0
down vote
favorite
I want to authenticate my GSuite users using my own .net core web application as Identity Provider.
https://support.google.com/a/answer/60224?hl=en
However, I don't know where to even start. I've been actively and diligently looking for the solution but all of them are from commerce company and it is a bit over-kill to use their service.
A good commercial provider is:
https://www.componentpro.com/products/saml
Is there a hidden gem open source libraries somewhere that I missed?
I know this question is quite general but any help is much much appreciated.
.net asp.net-core .net-core single-sign-on saml
asked Nov 9 at 9:01
Trong Hiep Le
31
add a comment |
up vote
0
down vote
favorite
I want to authenticate my GSuite users using my own .net core web application as Identity Provider.
https://support.google.com/a/answer/60224?hl=en
However, I don't know where to even start. I've been actively and diligently looking for the solution but all of them are from commerce company and it is a bit over-kill to use their service.
A good commercial provider is:
https://www.componentpro.com/products/saml
Is there a hidden gem open source libraries somewhere that I missed?
I know this question is quite general but any help is much much appreciated.
.net asp.net-core .net-core single-sign-on saml
asked Nov 9 at 9:01
Trong Hiep Le
31
You could use Microsoft WIF msdn.microsoft.com/en-us/library/ee748475.aspx directly. However I would find it quite challenging to really implement a SAMLv2 compliant Identity Provider yourself. Could it be that you actually only want to provide SSO to your web application leveraging Google's SAMLv2 IdP?
– Bernhard Thalmayr
Nov 9 at 15:11
1
You can use Identity Server 4 docs.identityserver.io/en/release/quickstarts/…
– Ahmed Mansour
Nov 9 at 18:04
@BernhardThalmayrWIFis not meant to act as an IdP, just as an SP. It also has no support for SAML2-P (protocol) wich is needed. Your link also takes to oldWIFwhich has been deprecated for some years now.WIFis a no-go here. There is no official SAML2 stack for .NET and you must have good faith to trust on the only two 'production-ready' paid components.
– Anderson Matos
Nov 10 at 17:17
@AndersonMatos thanks for pointing this out. As Azure AD and ADFS offers SAMLv2 support, I'm sure Microsoft is using some library. I thought at least in ADFS WIF is used for this.
– Bernhard Thalmayr
Nov 12 at 10:25
yes, there must be some libraries out there already :)
– Trong Hiep Le
Nov 14 at 8:48
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I want to authenticate my GSuite users using my own .net core web application as Identity Provider.
https://support.google.com/a/answer/60224?hl=en
However, I don't know where to even start. I've been actively and diligently looking for the solution but all of them are from commerce company and it is a bit over-kill to use their service.
A good commercial provider is:
https://www.componentpro.com/products/saml
Is there a hidden gem open source libraries somewhere that I missed?
I know this question is quite general but any help is much much appreciated.
.net asp.net-core .net-core single-sign-on saml
asked Nov 9 at 9:01
Trong Hiep Le
31
I want to authenticate my GSuite users using my own .net core web application as Identity Provider.
https://support.google.com/a/answer/60224?hl=en
However, I don't know where to even start. I've been actively and diligently looking for the solution but all of them are from commerce company and it is a bit over-kill to use their service.
A good commercial provider is:
https://www.componentpro.com/products/saml
Is there a hidden gem open source libraries somewhere that I missed?
I know this question is quite general but any help is much much appreciated.
.net asp.net-core .net-core single-sign-on saml
.net asp.net-core .net-core single-sign-on saml
asked Nov 9 at 9:01
Trong Hiep Le
31
asked Nov 9 at 9:01
Trong Hiep Le
31
asked Nov 9 at 9:01
Trong Hiep Le
31
asked Nov 9 at 9:01
Trong Hiep Le
31
asked Nov 9 at 9:01
Trong Hiep Le
31
31
You could use Microsoft WIF msdn.microsoft.com/en-us/library/ee748475.aspx directly. However I would find it quite challenging to really implement a SAMLv2 compliant Identity Provider yourself. Could it be that you actually only want to provide SSO to your web application leveraging Google's SAMLv2 IdP?
– Bernhard Thalmayr
Nov 9 at 15:11
1
You can use Identity Server 4 docs.identityserver.io/en/release/quickstarts/…
– Ahmed Mansour
Nov 9 at 18:04
@BernhardThalmayrWIFis not meant to act as an IdP, just as an SP. It also has no support for SAML2-P (protocol) wich is needed. Your link also takes to oldWIFwhich has been deprecated for some years now.WIFis a no-go here. There is no official SAML2 stack for .NET and you must have good faith to trust on the only two 'production-ready' paid components.
– Anderson Matos
Nov 10 at 17:17
@AndersonMatos thanks for pointing this out. As Azure AD and ADFS offers SAMLv2 support, I'm sure Microsoft is using some library. I thought at least in ADFS WIF is used for this.
– Bernhard Thalmayr
Nov 12 at 10:25
yes, there must be some libraries out there already :)
– Trong Hiep Le
Nov 14 at 8:48
add a comment |
You could use Microsoft WIF msdn.microsoft.com/en-us/library/ee748475.aspx directly. However I would find it quite challenging to really implement a SAMLv2 compliant Identity Provider yourself. Could it be that you actually only want to provide SSO to your web application leveraging Google's SAMLv2 IdP?
– Bernhard Thalmayr
Nov 9 at 15:11
1
You can use Identity Server 4 docs.identityserver.io/en/release/quickstarts/…
– Ahmed Mansour
Nov 9 at 18:04
@BernhardThalmayrWIFis not meant to act as an IdP, just as an SP. It also has no support for SAML2-P (protocol) wich is needed. Your link also takes to oldWIFwhich has been deprecated for some years now.WIFis a no-go here. There is no official SAML2 stack for .NET and you must have good faith to trust on the only two 'production-ready' paid components.
– Anderson Matos
Nov 10 at 17:17
@AndersonMatos thanks for pointing this out. As Azure AD and ADFS offers SAMLv2 support, I'm sure Microsoft is using some library. I thought at least in ADFS WIF is used for this.
– Bernhard Thalmayr
Nov 12 at 10:25
yes, there must be some libraries out there already :)
– Trong Hiep Le
Nov 14 at 8:48
You could use Microsoft WIF msdn.microsoft.com/en-us/library/ee748475.aspx directly. However I would find it quite challenging to really implement a SAMLv2 compliant Identity Provider yourself. Could it be that you actually only want to provide SSO to your web application leveraging Google's SAMLv2 IdP?
– Bernhard Thalmayr
Nov 9 at 15:11
You could use Microsoft WIF msdn.microsoft.com/en-us/library/ee748475.aspx directly. However I would find it quite challenging to really implement a SAMLv2 compliant Identity Provider yourself. Could it be that you actually only want to provide SSO to your web application leveraging Google's SAMLv2 IdP?
– Bernhard Thalmayr
Nov 9 at 15:11
1
1
You can use Identity Server 4 docs.identityserver.io/en/release/quickstarts/…
– Ahmed Mansour
Nov 9 at 18:04
You can use Identity Server 4 docs.identityserver.io/en/release/quickstarts/…
– Ahmed Mansour
Nov 9 at 18:04
@BernhardThalmayr
WIF is not meant to act as an IdP, just as an SP. It also has no support for SAML2-P (protocol) wich is needed. Your link also takes to old WIF which has been deprecated for some years now. WIF is a no-go here. There is no official SAML2 stack for .NET and you must have good faith to trust on the only two 'production-ready' paid components.– Anderson Matos
Nov 10 at 17:17
@BernhardThalmayr
WIF is not meant to act as an IdP, just as an SP. It also has no support for SAML2-P (protocol) wich is needed. Your link also takes to old WIF which has been deprecated for some years now. WIF is a no-go here. There is no official SAML2 stack for .NET and you must have good faith to trust on the only two 'production-ready' paid components.– Anderson Matos
Nov 10 at 17:17
@AndersonMatos thanks for pointing this out. As Azure AD and ADFS offers SAMLv2 support, I'm sure Microsoft is using some library. I thought at least in ADFS WIF is used for this.
– Bernhard Thalmayr
Nov 12 at 10:25
@AndersonMatos thanks for pointing this out. As Azure AD and ADFS offers SAMLv2 support, I'm sure Microsoft is using some library. I thought at least in ADFS WIF is used for this.
– Bernhard Thalmayr
Nov 12 at 10:25
yes, there must be some libraries out there already :)
– Trong Hiep Le
Nov 14 at 8:48
yes, there must be some libraries out there already :)
– Trong Hiep Le
Nov 14 at 8:48
add a comment |
2 Answers
2
active
oldest
votes
up vote
1
down vote
accepted
There is NO official SAML2 stack for .NET.
To build a SAML-compliant Identity Provider for federated identity you'll need not only SAML tokens but SAML protocol (v2 is the only one I've seen being supported by external providers like Google, Okta, Auth0, AWS Cognito and others). They all use either SAML 1.1 or 2.0 tokens from within SAML 2.0 protocol.
From a long research (still goind on) I came to only one free SAML2 library I'd trust: Sustainsys (you can find it on NuGet). It will enable SAML2 (including the protocol) on your application, perform assertion validation and all. Looks interesting but it will work only for new projects.
You can rely on two paid suites, too: ComponentPro and ComponentSpace (the last one sounds more stable/robust but it's merely a feeling, as you cannot find real-proof that it has been used by all those companies on a real-world production app.
You can create a SAML2-P compliant app/module but you'll have to handle signatures, message receival, validation, assertions and more. I'd recommend against that as it's quite easy to miss something which could later be exploited as a security breach.
You might use other federation alternatives
SAML is not the only path here. You might give a try to OpenID Connect or WS-Federation as well. Check more on Authentication Federation topic and you'll find other protocols. One might solve your problem easier than with SAML.
answered Nov 10 at 17:33
Anderson Matos
2,44811730
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
add a comment |
up vote
0
down vote
Agree with @Anderson here.
Some points:
Do NOT write your own - it's hard and insecure.
A list of the stacks you can use.
A list of how to use them.
Yes - identityserver is a good choice.
I have used ComponentSpace, Rock Solid Knowledge and Sustainsys. They are all good products and I can recommend them.
Another option is to use Identity as a Service e.g. Azure AD. Auth0, Okta etc. They all support SAML.
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
add a comment |
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
1
down vote
accepted
There is NO official SAML2 stack for .NET.
To build a SAML-compliant Identity Provider for federated identity you'll need not only SAML tokens but SAML protocol (v2 is the only one I've seen being supported by external providers like Google, Okta, Auth0, AWS Cognito and others). They all use either SAML 1.1 or 2.0 tokens from within SAML 2.0 protocol.
From a long research (still goind on) I came to only one free SAML2 library I'd trust: Sustainsys (you can find it on NuGet). It will enable SAML2 (including the protocol) on your application, perform assertion validation and all. Looks interesting but it will work only for new projects.
You can rely on two paid suites, too: ComponentPro and ComponentSpace (the last one sounds more stable/robust but it's merely a feeling, as you cannot find real-proof that it has been used by all those companies on a real-world production app.
You can create a SAML2-P compliant app/module but you'll have to handle signatures, message receival, validation, assertions and more. I'd recommend against that as it's quite easy to miss something which could later be exploited as a security breach.
You might use other federation alternatives
SAML is not the only path here. You might give a try to OpenID Connect or WS-Federation as well. Check more on Authentication Federation topic and you'll find other protocols. One might solve your problem easier than with SAML.
answered Nov 10 at 17:33
Anderson Matos
2,44811730
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
add a comment |
up vote
1
down vote
accepted
There is NO official SAML2 stack for .NET.
To build a SAML-compliant Identity Provider for federated identity you'll need not only SAML tokens but SAML protocol (v2 is the only one I've seen being supported by external providers like Google, Okta, Auth0, AWS Cognito and others). They all use either SAML 1.1 or 2.0 tokens from within SAML 2.0 protocol.
From a long research (still goind on) I came to only one free SAML2 library I'd trust: Sustainsys (you can find it on NuGet). It will enable SAML2 (including the protocol) on your application, perform assertion validation and all. Looks interesting but it will work only for new projects.
You can rely on two paid suites, too: ComponentPro and ComponentSpace (the last one sounds more stable/robust but it's merely a feeling, as you cannot find real-proof that it has been used by all those companies on a real-world production app.
You can create a SAML2-P compliant app/module but you'll have to handle signatures, message receival, validation, assertions and more. I'd recommend against that as it's quite easy to miss something which could later be exploited as a security breach.
You might use other federation alternatives
SAML is not the only path here. You might give a try to OpenID Connect or WS-Federation as well. Check more on Authentication Federation topic and you'll find other protocols. One might solve your problem easier than with SAML.
answered Nov 10 at 17:33
Anderson Matos
2,44811730
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
add a comment |
up vote
1
down vote
accepted
up vote
1
down vote
accepted
There is NO official SAML2 stack for .NET.
To build a SAML-compliant Identity Provider for federated identity you'll need not only SAML tokens but SAML protocol (v2 is the only one I've seen being supported by external providers like Google, Okta, Auth0, AWS Cognito and others). They all use either SAML 1.1 or 2.0 tokens from within SAML 2.0 protocol.
From a long research (still goind on) I came to only one free SAML2 library I'd trust: Sustainsys (you can find it on NuGet). It will enable SAML2 (including the protocol) on your application, perform assertion validation and all. Looks interesting but it will work only for new projects.
You can rely on two paid suites, too: ComponentPro and ComponentSpace (the last one sounds more stable/robust but it's merely a feeling, as you cannot find real-proof that it has been used by all those companies on a real-world production app.
You can create a SAML2-P compliant app/module but you'll have to handle signatures, message receival, validation, assertions and more. I'd recommend against that as it's quite easy to miss something which could later be exploited as a security breach.
You might use other federation alternatives
SAML is not the only path here. You might give a try to OpenID Connect or WS-Federation as well. Check more on Authentication Federation topic and you'll find other protocols. One might solve your problem easier than with SAML.
answered Nov 10 at 17:33
Anderson Matos
2,44811730
There is NO official SAML2 stack for .NET.
To build a SAML-compliant Identity Provider for federated identity you'll need not only SAML tokens but SAML protocol (v2 is the only one I've seen being supported by external providers like Google, Okta, Auth0, AWS Cognito and others). They all use either SAML 1.1 or 2.0 tokens from within SAML 2.0 protocol.
From a long research (still goind on) I came to only one free SAML2 library I'd trust: Sustainsys (you can find it on NuGet). It will enable SAML2 (including the protocol) on your application, perform assertion validation and all. Looks interesting but it will work only for new projects.
You can rely on two paid suites, too: ComponentPro and ComponentSpace (the last one sounds more stable/robust but it's merely a feeling, as you cannot find real-proof that it has been used by all those companies on a real-world production app.
You can create a SAML2-P compliant app/module but you'll have to handle signatures, message receival, validation, assertions and more. I'd recommend against that as it's quite easy to miss something which could later be exploited as a security breach.
You might use other federation alternatives
SAML is not the only path here. You might give a try to OpenID Connect or WS-Federation as well. Check more on Authentication Federation topic and you'll find other protocols. One might solve your problem easier than with SAML.
answered Nov 10 at 17:33
Anderson Matos
2,44811730
edited Nov 10 at 17:38
answered Nov 10 at 17:33
Anderson Matos
2,44811730
answered Nov 10 at 17:33
Anderson Matos
2,44811730
answered Nov 10 at 17:33
Anderson Matos
2,44811730
2,44811730
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
add a comment |
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
It would really be interesting what the actual use-case is as the question mentioned 'Identity Provider' which could also indicate 'authentication' and not 'SSO' (through what ever protocol). Potentially the questions was not phrased correctly.
– Bernhard Thalmayr
Nov 12 at 10:30
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
I mention Identity Provider as that is the term that Google are using; it's not crystal clear but don't know how to make it clearer :)
– Trong Hiep Le
Nov 14 at 8:54
add a comment |
up vote
0
down vote
Agree with @Anderson here.
Some points:
Do NOT write your own - it's hard and insecure.
A list of the stacks you can use.
A list of how to use them.
Yes - identityserver is a good choice.
I have used ComponentSpace, Rock Solid Knowledge and Sustainsys. They are all good products and I can recommend them.
Another option is to use Identity as a Service e.g. Azure AD. Auth0, Okta etc. They all support SAML.
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
add a comment |
up vote
0
down vote
Agree with @Anderson here.
Some points:
Do NOT write your own - it's hard and insecure.
A list of the stacks you can use.
A list of how to use them.
Yes - identityserver is a good choice.
I have used ComponentSpace, Rock Solid Knowledge and Sustainsys. They are all good products and I can recommend them.
Another option is to use Identity as a Service e.g. Azure AD. Auth0, Okta etc. They all support SAML.
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
add a comment |
up vote
0
down vote
up vote
0
down vote
Agree with @Anderson here.
Some points:
Do NOT write your own - it's hard and insecure.
A list of the stacks you can use.
A list of how to use them.
Yes - identityserver is a good choice.
I have used ComponentSpace, Rock Solid Knowledge and Sustainsys. They are all good products and I can recommend them.
Another option is to use Identity as a Service e.g. Azure AD. Auth0, Okta etc. They all support SAML.
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
Agree with @Anderson here.
Some points:
Do NOT write your own - it's hard and insecure.
A list of the stacks you can use.
A list of how to use them.
Yes - identityserver is a good choice.
I have used ComponentSpace, Rock Solid Knowledge and Sustainsys. They are all good products and I can recommend them.
Another option is to use Identity as a Service e.g. Azure AD. Auth0, Okta etc. They all support SAML.
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
answered Nov 11 at 18:21
nzpcmad
27.8k2892141
27.8k2892141
add a comment |
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53222608%2fimplement-dotnet-core-identity-provider-server-for-google%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You could use Microsoft WIF msdn.microsoft.com/en-us/library/ee748475.aspx directly. However I would find it quite challenging to really implement a SAMLv2 compliant Identity Provider yourself. Could it be that you actually only want to provide SSO to your web application leveraging Google's SAMLv2 IdP?
– Bernhard Thalmayr
Nov 9 at 15:11
1
You can use Identity Server 4 docs.identityserver.io/en/release/quickstarts/…
– Ahmed Mansour
Nov 9 at 18:04
@BernhardThalmayr
WIFis not meant to act as an IdP, just as an SP. It also has no support for SAML2-P (protocol) wich is needed. Your link also takes to oldWIFwhich has been deprecated for some years now.WIFis a no-go here. There is no official SAML2 stack for .NET and you must have good faith to trust on the only two 'production-ready' paid components.– Anderson Matos
Nov 10 at 17:17
@AndersonMatos thanks for pointing this out. As Azure AD and ADFS offers SAMLv2 support, I'm sure Microsoft is using some library. I thought at least in ADFS WIF is used for this.
– Bernhard Thalmayr
Nov 12 at 10:25
yes, there must be some libraries out there already :)
– Trong Hiep Le
Nov 14 at 8:48