1

I work on a Software-as-a-Service product, and right now all user authentication is done in our backend code, which is reading the user credentials (email + password) from a PostgreSQL database. We have received multiple requests from current and prospective customers to allow authentication against their existing Active Directory servers.

There are a number of software products that I know of that will allow me to authenticate users against a choice of multiple login servers - either their corporate SAML servers or our local database. Products I have considered include:

I find myself really leaning toward Gluu or Keycloak (the former is more configurable while the latter is more polished), but they both have one major feature that is missing: Email-domain-based redirection to the appropriate IdP server.

Basically, here is how it works:

  1. User goes to application, and is redirected to login page.
  2. User enters email address on login page.
  3. Authentication program parses email address and checks domain name. If domain is registered to log in with an external IdP, user is redirected to that IdP to complete login.
  4. If user's domain is not set to external login, user is prompted for password, which is checked against local database.

This procedure is used by Google, Microsoft, Adobe, and many other major service providers to handle 3rd-party login services, but it is not available in any of the products I have tried.

I am looking for either a plugin for one of the above products that will do what I want, or alternatively another product that has the missing feature.

For completeness, here are all my requirements:

  • F/OSS
  • Can run on Ubuntu 18.04
  • Built with any major programming language (Java, PHP, C, Go, Python, etc.)
  • Custom Theme-able
  • Supports multiple "upstream" SAML and OIDC servers, and can associate specific domain names with each one.
  • Fallback to local database (SQL or LDAP) if there is no matching upstream server for the domain.
  • Uses the procedure described above to choose an upstream login provider, and does not display a list of all configured providers.

Additional preferred features:

These aren't deal-breakers not to have, but it would be nice.

  • Plays nicely with other applications - doesn't try to take over the entire server (like Gluu does)
  • Simple High-Availability configuration
  • Auto-registration of new users from upstream IdP's into the local database if they have the correct attributes set in the response.
  • Allows multiple themes depending on domain name and/or URL visited.
2

I've used Apereo CAS in the past. I think your 1 to 4 steps flow is covered by it.

It features many of your other desired requirements:

  • F/LOSS.
  • Can run on Ubuntu 18.04.
  • Built with a major programming language (Java).
  • Custom Theme-able.
  • Supports multiple "upstream" SAML and OIDC servers, and can associate specific domain names with each one.
  • SQL and LDAP features.
  • Doesn't try to take over the entire server.
  • High-Availability configuration.
  • Auto-registration of new users from upstream IdP's into the local database if they have the correct attributes set in the response. I had it at the shop where I handled their CAS, but was a custom development, but it was an old version so newer maybe have a nice builtin for this...
  • Allows multiple themes depending on domain name and/or URL visited.
  • 1
    I used to use CAS way back when it was still JASIG CAS, and had nowhere near the feature-set it has today. I'll have to take another look at it. – Moshe Katz Sep 16 at 14:10
  • 1
    Yeah it has a lot of features. Many of them are contributed. If it doesn’t provide anything and someone asks for it, they encourage users develop the features themselves. – 59507 Sep 16 at 16:15
  • So I asked the CAS mailing list about my requirements, and it wasn't so clear that it will do what I want. I might just end up writing my own software. – Moshe Katz Oct 31 at 16:47
  • ... link to post in mailing list archives? – 59507 Oct 31 at 17:41
  • 1
    ... this? – 59507 Oct 31 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.