REST API authentication with SAML

Question

I'm struggling to design a SAML2.0 authentication for a REST API using a gateway. REST is used between my backend and my application. I'm using Java Servlet filter and Spring.

I see two possibilities:

1. Adding the SAML tokens into the header each time.

2. Authenticate once with SAML, then using a session or similar (secure conversation) between the client and the gateway.

Case 1: It's a good solution because we are still RESTful but:

• SAML tokens are quite big. It's may generated problem due to big header size.
• Replaying tokens is not the best way for security concern.

Case 2: It's no more stateless and I have to managed a link with the client. Since I use a gateway, the underlying services can still be RESTful.

Case 2 looks for the better choice despite the fact that it does not follow the rest constraints.

Is someone had already to do it and give me some pointers (for design or implementation)?

Is there a better way to do it with SAML?

Any help or advice are welcome.

Langlauf

Use the second approach. Many service providers will reject replayed tokens anyway. Is this to authenticate users or your client software? – Pentagrid

It is to authenticate users – Langlauf

You may also have a look using OAuth2 for the same if you're open to have SAML alternate. – Ophthalmitis

There is no such thing as a SAML token. Did you mean putting the SAML Assertion in an Authorization header? Because a SAML assertion can only be consumed once, since it has a unique ID (to prevent replay attacks). Also, each SAML assertion typically only has a small window of time in which it is valid (usually just a few minutes). – Pipestone

Answer 1

It is still draft, but: the OAuth2 SAML bearer profile may a possible solution. https://datatracker.ietf.org/doc/html/draft-ietf-oauth-saml2-bearer-17

Use a SAML2 to authenticate to an OAuth2 provider, then call your service with the OAuth2 token.

Barghest

Oh, I'd not herd of that. – Pentagrid

It looks to be the way to go. Several big names of the web use OAuth with JSON web token (JWT) to secure their REST service. Also refer to this draft: http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-05#page-21 and to Security tokens service (STS) keyworld – Langlauf

So, how do I used SAML2 to authenticate an OAuth2 provider? – Hasen

You use an STS to do the translation. It will eat an OAuth2 token and generate a SAML2 token. – Langlauf

How the signed/encrypted assertion can be passed? Does the Caller has to decrypt them? – Terminator

The token is either pass through the browser or add by a proxy. It doesn't change from a standard authentication workflow excepted you are doing it twice. – Langlauf

Answer 2

Also, you could generate a jwt token and put it inside of a SAML attribute: from this moment on you could pass the jwt inside of an http header.

It is sort of mixing oauth with saml but if you still need the latter for authentication it could be the way to go.

Iconoscope