Lion Cipher Lab
Federate an app with SAML 2.0 — and read the assertion off the wire
- Identity & Access Management
- Intermediate
- ~90 min
- Free · no account required
Why it matters
If you take an identity, security or IT job at any company bigger than a startup, you will meet SAML in your first month — and probably in the form of a broken login you are expected to fix. SAML 2.0 is the protocol that sits underneath most enterprise single sign-on that exists today: Okta, Microsoft Entra ID and Ping fronting Salesforce, Workday, ServiceNow, Zoom, AWS, and a long tail of internal applications too old or too expensive to modernise. It has been an OASIS standard since 2005 and it is not going anywhere, because thousands of vendors implement it and nobody rewrites a working…
What you'll learn
- SAML 2.0 federation
- identity provider vs service provider
- reading a decoded SAML assertion
- SAML metadata and entityID
- NameID formats (persistent / transient / email)
- Conditions, NotOnOrAfter and AudienceRestriction
- AttributeStatement-driven authorization
- XML signature verification and XSW as a class of bug
- certificate rotation as an SSO outage cause
- choosing between SAML and OIDC
Steps in this lab
- From zero: what 'federation' means, and the cast of characters
- Why bother with a 2005 protocol — and what you are about to build
- Start Keycloak in Docker
- Create the two realms: one plays the employer, one plays the app
- In corp-idp: create the employee and a group
- Look at the IdP's metadata — the XML that makes federation possible
- In corp-idp: register the application as a SAML client
- Add mappers so real attributes cross the boundary
- In app-sp: consume corp-idp as an external SAML identity provider
- Open DevTools, then watch the hand-off happen
- Capture the SAMLResponse and decode it
- What you are looking at — a real decoded assertion, trimmed
- Issuer, Subject and NameID — who minted it, and who the user is
- Conditions and AudienceRestriction — the two things that stop reuse
- AttributeStatement — how group membership crosses the boundary, and why that IS the game
- The Signature — what is signed, and the bug class that lives here
- Certificate rotation — why SSO breaks on a Tuesday morning
- SP-initiated vs IdP-initiated, and why one is discouraged
- The judgment call: SAML or OIDC?
- What NEITHER protocol gives you: logout, clocks, and the debugging move
- Clean up — and what is left on your machine