OpenLDAP是否支持SAML 2.0认证请求？项目技术咨询

Great question! Let's break this down clearly—OpenLDAP itself does not natively support receiving SAML 2.0 authentication requests. It's built as a directory service focused on storing and managing identity data (like user credentials, group memberships) using LDAP-specific protocols, not SAML.

SAML 2.0 is a federated identity standard designed for exchanging authentication and authorization data between identity providers (IdPs) and service providers (SPs). OpenLDAP lacks the built-in endpoints, parsing logic, and SAML-specific processing needed to handle these requests directly out of the box.

That said, you absolutely can make this workflow work with a small bit of extra infrastructure. You'll need an intermediary component to bridge the SAML 2.0 request to OpenLDAP's LDAP-based authentication. Here are the most practical approaches:

• Use a SAML Identity Provider (IdP) that integrates with OpenLDAP: Tools like Shibboleth IdP, Keycloak, or SimpleSAMLphp are perfect for this. You configure the IdP to use your OpenLDAP server as its user data store. Your application sends the SAML 2.0 authentication request to the IdP, which then queries OpenLDAP to validate the user's credentials, and finally returns a SAML response back to your app.
• Deploy a SAML-to-LDAP proxy: Specialized proxies (like OpenAM, or even a custom lightweight service) can receive SAML requests, translate them into standard LDAP bind operations to authenticate against OpenLDAP, and generate the appropriate SAML response for the requester.

As a concrete example, if you go with Keycloak:

1. Set up Keycloak as your SAML IdP instance.
2. Add a user federation provider in Keycloak, pointing to your OpenLDAP server (configure LDAP URL, bind DN, user search base, and credential validation rules).
3. Your application sends a SAML 2.0 AuthnRequest to Keycloak's dedicated SAML endpoint.
4. Keycloak checks OpenLDAP for the user's credentials, verifies them, and sends a signed SAML Assertion back to your application.

So to sum up: OpenLDAP can't handle SAML 2.0 requests on its own, but with the right intermediary IdP or proxy, you can seamlessly integrate the two to achieve your project's authentication goals.

内容的提问来源于stack exchange，提问作者P G