基于PingOne（IdP）实现SP发起式SSO的技术咨询
Absolutely, PingOne fully supports SP-initiated SSO, and since you already have IdP-initiated working with your custom app, the transition should be straightforward with a few key configuration tweaks and code changes on your SP side. Here's a step-by-step breakdown to make it happen:
1. Update Your PingOne Application Configuration
First, log into your PingOne Admin Console and navigate to the application you already set up for IdP-initiated SSO:
- Go to Applications > Select your custom app > Edit > Navigate to the SAML configuration tab.
- Ensure the following settings are properly configured (most might already be set from your IdP-initiated setup, but double-check):
- Entity ID: Your SP's unique identifier (must match what your app sends in AuthnRequests).
- ACS URL: The callback endpoint on your SP where PingOne will send the SAML Response (this should be a secure HTTPS URL).
- Enable SP-Initiated SSO: Look for a toggle or setting explicitly enabling this (it might be labeled "Allow SP-initiated authentication" or similar).
- NameID Format: Choose the format your SP expects (e.g.,
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressif you're using user emails as identifiers). - Save the changes. You can also download PingOne's IdP metadata here (you'll need the IdP SSO endpoint URL and signing certificate for your SP code).
2. Implement SP-Initiated AuthnRequest Generation in Your Custom App
Your SP needs to generate a valid SAML 2.0 AuthnRequest and send it to PingOne's SSO endpoint. Here's what you need to include:
- Issuer: Your SP's Entity ID (matches what you set in PingOne).
- Destination: PingOne's SSO endpoint URL (found in the IdP metadata or PingOne app settings).
- NameIDPolicy: Specifies the desired NameID format and whether it's mandatory.
- RelayState (optional but recommended): A value to preserve the user's original context (e.g., the page they were trying to access before login) so you can redirect them back after authentication.
You can generate the AuthnRequest programmatically using a SAML library for your tech stack—like python3-saml for Python, SAML2 for .NET, or saml-js for Node.js—or manually for testing. For example, a simplified HTTP Redirect AuthnRequest would look like this (URL-encoded):
https://<pingone-sso-endpoint>?SAMLRequest=<url-encoded-base64-saml-request>&RelayState=<your-relay-state>
3. Handle PingOne's SAML Response on Your SP
Once the user authenticates with PingOne, PingOne will send a SAML Response to your SP's ACS URL via HTTP POST. Your app needs to:
- Validate the signature of the SAML Response using PingOne's public signing certificate (from the IdP metadata).
- Parse the SAML Assertion to extract user attributes (like email, username, or custom attributes you configured in PingOne).
- Create a session for the authenticated user in your application, using the extracted user data.
- (If using RelayState) Redirect the user to the original page specified in the RelayState parameter.
4. Test the Flow
- Start by accessing a protected route in your custom app. Your app should redirect the user to PingOne's login page with the generated AuthnRequest.
- After the user logs in successfully, they should be redirected back to your app's ACS endpoint, authenticated, and sent to the intended page.
- Debug any issues by checking PingOne's admin logs (under Reports > Audit Logs) and your SP's application logs—common issues include mismatched Entity IDs, invalid ACS URLs, or signature validation failures.
内容的提问来源于stack exchange，提问作者Rajesh A
