[keycloak-user] SAML Binding - ECP Profile

[John Dennis]

On 02/13/2017 02:03 PM, Jason B wrote:
> Thank for the detailed response. I agree with you.
>
> Actually the requirement, I am trying to implement is IdP discovery
> services. I want to find out a correct realm for a user based on use's
> email address. Initially I thought it can be implemented using ECP profile
> but later realized it is not the solution I am looking for.
>
> Thinking of writing a UI service infront of keycloak to intercept the
> incoming AuthN request (SP SSO) to capture the user's email address to
> determine the correct realm IDP.

Huh? That doesn't make much sense. The SP *must* know a priori the 
Keycloak realm because in Keycloak an IdP is owned by a realm. In 
addition the SAML AuthnRequest *must* already include the Keycloak realm 
in the request *and* the request *must* be sent to an binding endpoint 
in the the Keycloak realm.

Further more any Keycloak deployment which permits sniffing SAML 
messages is fundamentally broken (because it should be deployed using 
TLS). Not to mention even if you bypassed TLS you still would not be 
able to decrypt any SAML messages where the SP requires encryption 
because you don't have access to the encryption key.

And yet another problem in your proposal is that an AuthnRequest does 
not (necessarily) contain an email address. Depending on how the client 
is configured it might supply an email address as an attribute in the 
Assertion. AuthnRequest != Assertion.

There are other ways to perform IdP discovery.


-- 
John