SAML IDP initiated SSO

[twenzel]

When moving from RSK.Saml to Duende the "IDP initiated SSO" feature is missing.

[maartenba]

We have a sample at https://github.com/DuendeSoftware/samples/tree/main/IdentityServer/v8/SAML/IdPInitiated which demonstrates how to do this. Is there anything from the sample you feel is missing? (happy to make updates to it)

[twenzel]

I'm talking about IDP-Initiated SSO where the IdentityServer is the SP. This is required when using IdentityServer as Federated Auth Gateway.

[wcabus]

@twenzel While we do have a configuration property AllowUnsolicitedAuthnResponse that would allow this flow when configuring the SAML Service Provider authentication handler, it seems that we're missing some bits to also configure the IdP's return URL, or to allow the IDP to provide their own via relay state.

I've forwarded this issue to our engineers to investigate further.

[bhazen]

Hi @twenzel. We released Duende IdentityServer 8.0.4 to address this gap.

There is documentation covering IdP-Initiated SSO as a Service Provider and migrating from RSK.SAML to Duende.

Please let us know if you have any further questions or feedback.