1

We want to provide organisations the ability to integrate their internal Active Directory (AD) with our external cloud product.

Our client has a federation server using ADFS, we understand that for us to work with more than one client on this level, we need to have our own ADFS service. Does this mean we could use SCIM as a replacement?

steve0nz
  • 906
  • 5
  • 16
  • 35
  • When you say SCIM do you mean "Simple Cloud Identity Management"? That's a protocol not an STS. – rbrayb Jul 31 '13 at 19:04

2 Answers2

3

You don't need an ADFS server on your side. Although you could use it, it has a few disadvantages: relatively complex deployment, complex automation, limited protocols support, etc. You will likely spend quite a bit of time tweaking it into doing what you need. Of course this is my own experience with it.

Conceptually, you are right. You need an intermediary (typically called an "Federation Provider" that brokers authentication transactions between your app and any system that knows about users like your customer's ADFS).

You might want to check an alternative that is lighter weight, cloud ready, and easier to extend. Fortunately you have many options:

1- You can use IdentityServer, an open source product that you could deploy next to your service. It's an open source product that you can extend and customize as you see fit; and gives you tons of flexibility. Since it is OSS you can "own" the stack and do whatever you want.

2- You can use Azure AD which is a hosted Federation Provider by Microsoft. It'll work with ADFS and other common providers; but has some limitations. (For example: it won't allow you to easily keep your own user database, it will not normalize user profiles, among some common things you are likely to need).

3- You can use Auth0 which is optimized for scenarios like yours. (Full disclosure: this is the product I work on).

In any case, you can read more about the architecture of scenarios like this here.

Eugenio Pace
  • 14,094
  • 1
  • 34
  • 43
  • Thanks for the info @eugeno_pace do we still need SAML or OAUTH on our end? – steve0nz Jul 31 '13 at 07:46
  • ... It was my understanding; for us to allow multiple IDPs to send their users to us, we will need some form of SCRIM or ADFS service. How else do we authenticate/provision users? – steve0nz Jul 31 '13 at 07:55
  • Yes, your app needs to accepts security tokens (if using SAML or WS-Fed) or implement OAuth. Yes, your customers need to supply a token (or participate from the OAuth negotiation). Having an intermediary as I'm suggesting, isolates your app from any implementation details each of your customers have, and would also deal with on-boarding and provisioning. We (Auth0) have chosen to automate the on-boarding process too, becuase it is a common source of frustration. – Eugenio Pace Jul 31 '13 at 21:16
  • Steve - I'm not sure I got your e-mail (eugeniop at auth0.com) – Eugenio Pace Aug 01 '13 at 17:24
  • I sent a message with your online form – steve0nz Aug 04 '13 at 03:41
0

Chose to go with SimpleSAMLphp - we will accept the provisioning via the API Claims process. We already have group policies in place which makes the task easier.

steve0nz
  • 906
  • 5
  • 16
  • 35