Search code examples
nginxsingle-sign-onsaml-2.0httpd.confpingfederate

PingFederate and NGinx integration and deployment options

Some time before we started to look how to integrate PingFederate into our infrastructure.

Our initial use case is following: we are providing multy tenant access to our application and different companies might use different(their) Identity providers to access our application.

Right now flow is limited to this workflow: Mutiple Idp(s) to one SP

However in the future flow might be extended to Many-to-many relations

Currently we are using NGINX as Reverse Proxy and based on PingFed documentation it's totally difficult to understand deployment options that we have right now.

Based on diagram that was taken from this guide PingFed and apache httpd integration

It's more or less clear how this integration works for apache httpd. Mainly there is apache PingFed Agent that works with SSO flows on apache and mainly it validates "session" or initiate SSO flow.

    Processing Steps
1. A user attempts to access a resource on the Apache server protected by the PingFederate
Apache Agent.
2. The user is redirected to the PingFederate server for authentication.
(If an OpenToken session already exists, the user is granted immediate access.)
3. The PingFederate server redirects the user’s browser to an IdP for authentication using either the
SAML or WS-Federation protocols. The IdP partner authenticates the user and returns a SAML
assertion.
4. PingFederate validates the assertion and creates an OpenToken for the user including any
configured attributes. PingFederate then redirects the browser, including the OpenToken, back to
the Apache Agent.
5. The Agent verifies the OpenToken and grants access to the protected resource. The User ID and
any attributes from the OpenToken are exposed to the resource as HTTP Request Headers or Apache Environment Variables.

And mainly on Step 5 apache agent passes information about User to the actual application using Request Headers or Apache Environment Variables.

Based on all info mentioned above here is 2 questions:

  1. How to make similar deployment for PingFed and NGINX (for option that described in this question with apache httpd)?
  2. Is it required to use Web Server(Reverse Proxy) together with PingFederate. Or Ping Federate can act also as WebServer? If yes probably some links and additional explanations are appreciated.
Solution
    1. There is no PingFederate agent architecture from Ping Identity that supports nginx. I would suggest you look into the "Agentless Adapter" (also known as reference adapter) and build your own.
    2. There is no requirement to use a reverse proxy with PingFederate. PingFederate uses Jetty as its web container, and is perfectly capable of serving traffic. We provide options for reverse proxy so as to support those organizations that have requirements against opening a port directly to an application server.