Search code examples
samlsaml-2.0adfsopensamlpingfederate

Can trusted credentials be used with SAML?


Can trusted credentials be used with SAML 2.0? Example of a use case would be like scheduling job.

SAML 2.0 doc/spec does not seem to indicate that this is supported, any one know of a workaround or suggestion to achieve goal of the above use case?


Solution

  • I think you're confused between SAML and the authentication mechanism at the Identity Provider (IdP). Ultimately, the limit on credentials is at the IdP. SAML, in and of itself, is agnostic about the authentication mechanism used at the IdP. It simply doesn't care. All it does is provide a standards-based method of carrying the authenticated ID's attribute(s) from IdP to SP (service provider).

    If you can authenticate to a service, and then carry the token you receive from the authentication mechanism to the IdP, which will convert that token into a SAML assertion, and then carry that SAML assertion to the SP, then you'll be set. This can all be done programmatically, even from a shell script, provided you can write the cURL scripting to do it...

    TL;DR: Yes, you can use "trusted credentials".

    Note: Check out what Hans Z. has to say in his comment on my answer. He's absolutely correct that there are "right" ways to do this - and it's definitely not going to be using cURL!