[CLOUDSTACK-8457] Make SAML plugin production grade

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.5.2, 4.6.0, Future
• Component/s: SAML
• Security Level: Public (Anyone can view this level - this is the default.)
• Assignee: Rohit Yadav
• Reporter: Rohit Yadav
• Created: 12/May/15 14:58
• Updated: 26/Apr/16 10:03
• Resolved: 29/Jun/15 11:10

Description

The current SAML plugin is not well tested with major IdPs used in production such as Shibboleth. It is also limited to using HTTP-redirect only and does not support HTTP-Post and other artifacts. Further, the security concerns are not well addressed, for example both authorization, creation of users/accounts (on first login) and authentication is done by the plugin which needs to be tested wrt security, addressed and improved.

Issue Links

• mentioned in: Page Loading...

Sub-Tasks

• Support Multiple IdPs, show list to users to select from etc.: Closed
• Improve SAML plugin to support multiple endpoint bindings: Closed
• SAML: Define and support supported IdP servers: Closed
• SAML: Ensure SP implementation compatibility with SAML standards of interoperability: Closed
• SAML: Auth plugin should handle authentication, admins to authorize users before they can authenticated: Closed
• SAML: Allow admin to specify attribute name returned by IdP: Closed
• SAML: allow IdP metadata XML to be saved in DB or a file: Closed
• SAML: allow sigalg configurable: Closed
• SAML: add metadata refresh worker/handler and handle https failures: Closed