本地ADFS替代方案：寻求可快速配置的SaaS型IDP用于SAML联邦测试

Got it, let's cut to the chase—you don't need to spin up Windows Server VMs and mess with AD/ADFS just for SAML testing. There are several free/cheap SaaS IDPs that let you set up a test user store and connect to your web app's SSO solution in minutes. Here are my top picks, with step-by-step configs tailored to your needs:

Okta Developer Edition (Free, Perfect for Fast Testing) #

This is my go-to for quick SAML tests because the UI is intuitive and the free tier gives you everything you need for testing.

• Sign up: Grab a free developer account (no credit card required) and log into the Okta dashboard.
• Set up test users: Head to Directory > People, click Add Person, and create a few test users. You can also bulk-import via CSV if you need more users fast. No AD integration needed—Okta's built-in user store works perfectly for testing.
• Create a SAML app integration:
  1. Go to Applications > Applications, click Create App Integration, and select SAML 2.0.
  2. Name your test app (e.g., "My Web App SAML Test") and click Next.
  3. Configure SAML settings:
     • Paste your web app's ACS URL (the one your internal SSO solution uses) into the Single sign-on URL field, and make sure the binding is set to POST.
     • For Audience URI (SP Entity ID), use whatever value your web app expects—if you don't have a specific one, you can use a placeholder like http://your-test-app.com/saml/metadata.
     • Leave other default settings as-is for testing, then click Next.
  4. Once the app is created, go to the Sign On tab. You'll find Okta's IDP metadata here—either download the XML file or copy the metadata URL, and feed this into your web app's SSO solution to establish trust.
• Test it out: Use your test user credentials to initiate an SSO flow to your web app. Verify that the SAML assertion is passed correctly and the login works.

Auth0 Free Tier (Great for Flexible SAML Configs) #

Auth0 is another solid option, especially if you want to test more complex SAML attribute mappings down the line.

• Sign up: Create a free Auth0 account and access the dashboard.
• Add test users: Navigate to User Management > Users, click Create User, and add test accounts with email/password.
• Set up a SAML app:
  1. Go to Applications > Applications, click Create Application, select Regular Web Applications, and hit Create.
  2. Switch to the Addons tab, find SAML2 Web App, and click Enable.
  3. In the SAML settings:
     • Paste your ACS URL into the Application Callback URL field.
     • Set the Audience to your web app's SP Entity ID.
     • You can tweak attribute mappings (like passing user email, name, etc.) in the Attributes section if needed—default mappings work for basic testing.
  4. Save the settings, then go to the Usage tab to get Auth0's IDP metadata. Import this into your web app's SSO solution.
• Test: Initiate SSO from your web app and confirm the test user can log in successfully.

Azure AD B2C (Ideal if You're in the Microsoft Ecosystem) #

If you're already familiar with Azure tools, B2C's free tier gives you enough capacity for testing SAML federation.

• Set up a B2C tenant: Create a free Azure account, then set up an Azure AD B2C tenant (follow the on-screen prompts—it's quick).
• Add test users: Go to Azure AD B2C > Users, click New user > Create local account, and add test users.
• Register your web app:
  1. Navigate to Azure AD B2C > App registrations, click New registration.
  2. Name your app, select Accounts in any identity provider or organizational directory, and paste your ACS URL into the Redirect URI field (choose the Web platform).
  3. After registration, go to Manage > Expose an API and set an Application ID URI (e.g., https://your-b2c-tenant.onmicrosoft.com/test-app).
  4. Create a user flow: Go to Azure AD B2C > User flows, click New user flow, select Sign up and sign in, choose the Recommended version, and set the token type to SAML. Add your registered app to this user flow.
  5. Get the IDP metadata: From the user flow's overview page, copy the SAML metadata endpoint URL and use it to configure your web app's SSO solution.
• Test: Trigger the SSO flow from your web app and verify login with a test user.

Quick Tips for Testing #

• All these SaaS IDPs let you customize SAML assertion attributes—if you need to test specific user data being passed, just adjust the attribute mappings in the app settings.
• Once you're done testing, you can easily delete the app and test users—no server cleanup required, which is way faster than tearing down an ADFS setup.

内容的提问来源于stack exchange，提问作者Varun