OmniAuth Web App will not Communicate with SAML-Based IdP
Last Updated:
Overview
There is a requirement to implement IdP-initiated login via the SAML protocol. In this particular arrangement, Auth0 is configured as the SP and a 3rd party platform has been configured to serve as the IdP.
However, the login flow fails to complete.
Cause
- OmniAuth does not by default have a SAML strategy
- The 3rd party IdP supports SAML but has no support for OIDC
- This may manifest itself on the application backend, as an error of type 'CSRF detected'. This may be explained by the fact that the application backend cannot identify a valid state, as it is not expecting a SAML response.
- The OmniAuth library is designed to firstly call start URL (GET/POST /auth0) and create a session state token and then in callback URL (GET/POST auth0/callback) it checks that the session exists, based on this state token.
- However, OmniAuth is expecting a response in JSON format, with various data based on provider strategy. It is not expecting a a SAML response, with the result that the login flow halts and a white screen is displayed.
Solution
Auth0 will output an OIDC response unless the "saml2 web addon" has been explicitly enabled (this is completely separate from setting up an external SAML IdP as a connection in Auth0).
For detailed information about implementing this function, refer to the document Configure IdP-Initiated SAML Sign-on to OIDC Apps.
Related References
- Adopt OIDC-Conformant Authentication
- SAML configuration
- Configure SAML Identity Provider-Initiated Single Sign-On
