Support SAML Authentication for All Identity Providers

The latest version of NPM supports SAML authentication for Okta and ADFS only. This functionality should be expanded so any SAML identity provider can be used to authenticate with Orion. This shouldn't be hard to do since SAML is an open standard which all identity providers use and support.

Find more posts tagged with

npm 12.4

orion core

saml

authentication

Status: None

Comments

mdhtbm

After being told that Orion's SAML authentication currently only works with ADFS and Okta, I tested with our F5 APM IdP. Since SAML is an open standard I figured it should work with any SAML provider. I found that it did indeed work just fine and was very easy to set up (less than 15 minutes), even though there was no documentation for how it works with F5's IdP. Based on this experience, I'd say anyone running a SAML 2.0 compatible IdP should be able to take advantage of Orion's SAML authentication features.

To make SAML authentication easier to implement, I'd like to see a feature to copy permissions from a local account to a SAML account (THWACK request here) as well as the ability to set up permission groups in Orion to which individual SAML accounts can be mapped (THWACK request here).

rcastril

I think they can improve what is already implemented to increase compatibility with other providers.
It is true that SAML is an open standard, however the data it contains is not exactly the same among SAML providers. For instance, the company I work for has a proprietary SAML server that send responses with groups in a key called "blueGroups".
In SolarWinds advanced configuration I can change from "orionGroups" to the name I want and this is great. What I feel that is missing is a flexible method to use the data provided by the SAML provider. It could be possible, for instance, to authenticate anyone with "isManager = true" in SAML assertion with a read-only profile, then show to this user a specific set of dashboards. This would be great.
There is also a bug where SolarWinds interface does not support commas in group names, and some SAML providers send the group names in their full DN, so it is not possible to authenticate. In fact, there is a workaround that involves editing the database directly. More on that here: SAML Bug - Forum - The Orion Platform - THWACK (solarwinds.com).