J2EE应用单客户SAML2 SSO集成咨询：是否需部署完整OpenAM实例

Great question! Let's break this down clearly for your specific use case:

Core Answer #

You do NOT need to deploy a full OpenAM instance to use the OpenAM Fedlet as your Service Provider (SP) for SAML2 SSO. Here's why and how it fits your scenario:

1. What the Fedlet Actually Is #

The OpenAM Fedlet is a lightweight, standalone SAML2 SP implementation packaged as a deployable WAR (or embeddable components) designed explicitly for this exact use case: integrating SAML2 SSO into existing applications without requiring a full OpenAM server deployment. It handles all the SAML2 protocol flow—like AuthnRequests, Assertion validation, and session establishment—directly with your customer's Identity Provider (IdP) independently.

2. Perfect Fit for Your Multi-Access Model #

Your requirement (one customer using SAML2 SSO, others using the existing login form) aligns perfectly with the Fedlet's capabilities:

• You can implement a routing layer in your J2EE app that checks the incoming user/customer context:
  • For the specific customer, redirect their login request to the Fedlet's SAML entry point.
  • For all other customers, route them to your existing credential-based login page.
• Once the SAML authentication completes successfully, the Fedlet will pass the authenticated user's identity to your J2EE app, letting you map that identity to your existing user permissions and grant access to the specific features.

3. Key Deployment & Configuration Notes #

• Metadata Exchange: You'll need to generate the Fedlet's SP metadata (usually accessible via a URL like /fedlet/metadata) and share it with your customer, while they provide their IdP's metadata for you to configure in the Fedlet.
• Session Sync: Ensure you handle session synchronization between the Fedlet and your J2EE app. For example, after the Fedlet validates the SAML assertion, you can create a session in your existing app tied to the authenticated user's identity.
• Container Compatibility: Deploy the Fedlet as a separate app in your existing container (Tomcat, JBoss, etc.)—just make sure it's in a domain/context that allows seamless identity handoff to your main J2EE application.

4. When Would You Need a Full OpenAM Instance? #

A full OpenAM deployment only becomes necessary if you need to:

• Support multiple IdPs for different customers and want a centralized way to manage them.
• Add centralized identity management features (user storage, role-based access control, password policies).
• Act as an IdP yourself for other services.
  None of these are required for your current use case.

内容的提问来源于stack exchange，提问作者John