User Authentication Server that picks upstream IdP by email domain

Question

I work on a Software-as-a-Service product, and right now all user authentication is done in our backend code, which is reading the user credentials (email + password) from a PostgreSQL database. We have received multiple requests from current and prospective customers to allow authentication against their existing Active Directory servers.

There are a number of software products that I know of that will allow me to authenticate users against a choice of multiple login servers - either their corporate SAML servers or our local database. Products I have considered include:

• Gluu
• Keycloak
• WSO2 Identity Server
• privacyIDEA

I find myself really leaning toward Gluu or Keycloak (the former is more configurable while the latter is more polished), but they both have one major feature that is missing: Email-domain-based redirection to the appropriate IdP server.

Basically, here is how it works:

1. User goes to application, and is redirected to login page.
2. User enters email address on login page.
3. Authentication program parses email address and checks domain name. If domain is registered to log in with an external IdP, user is redirected to that IdP to complete login.
4. If user's domain is not set to external login, user is prompted for password, which is checked against local database.

This procedure is used by Google, Microsoft, Adobe, and many other major service providers to handle 3rd-party login services, but it is not available in any of the products I have tried.

I am looking for either a plugin for one of the above products that will do what I want, or alternatively another product that has the missing feature.

For completeness, here are all my requirements:

• F/OSS
• Can run on Ubuntu 18.04
• Built with any major programming language (Java, PHP, C, Go, Python, etc.)
• Custom Theme-able
• Supports multiple "upstream" SAML and OIDC servers, and can associate specific domain names with each one.
• Fallback to local database (SQL or LDAP) if there is no matching upstream server for the domain.
• Uses the procedure described above to choose an upstream login provider, and does not display a list of all configured providers.

Additional preferred features:

These aren't deal-breakers not to have, but it would be nice.

• Plays nicely with other applications - doesn't try to take over the entire server (like Gluu does)
• Simple High-Availability configuration
• Auto-registration of new users from upstream IdP's into the local database if they have the correct attributes set in the response.
• Allows multiple themes depending on domain name and/or URL visited.

Answer 1

I've used Apereo CAS in the past. I think your 1 to 4 steps flow is covered by it.

It features many of your other desired requirements:

• F/LOSS.
• Can run on Ubuntu 18.04.
• Built with a major programming language (Java).
• Custom Theme-able.
• Supports multiple "upstream" SAML and OIDC servers, and can associate specific domain names with each one.
• SQL and LDAP features.
• Doesn't try to take over the entire server.
• High-Availability configuration.
• Auto-registration of new users from upstream IdP's into the local database if they have the correct attributes set in the response. I had it at the shop where I handled their CAS, but was a custom development, but it was an old version so newer maybe have a nice builtin for this...
• Allows multiple themes depending on domain name and/or URL visited.