SAML2 IdP/SP Federation Demo
This demo launches two Ahdapa instances on localhost – one as a SAML2 Identity Provider (IdP) and one as a SAML2 Service Provider (SP) – and exercises the full SSO flow with signed assertions.
What it shows
- IdP metadata generation at
/saml2/metadata(including signing certificate andArtifactResolutionService). - SP metadata generation at
/saml2/sp/metadata/{upstream_id}. - Admin API CRUD for SAML2 SP and upstream IdP registrations (including certificate extraction from IdP metadata).
- Full SP-initiated SSO flow: AuthnRequest redirect, IdP assertion with XML Digital Signature, ACS POST, session creation.
- SP-initiated Single Logout (
/saml2/slo/start/{upstream_id}). - SAML2-specific audit events (
saml2.idp-sso,saml2.sp-login,saml2.logout).
Prerequisites
curlpython3(for metadata XML parsing)
How to run
Non-interactive (automated test, exits with pass/fail):
bash contrib/demo/saml2/run.sh
Interactive (servers stay running for manual exploration):
bash contrib/demo/saml2/run.sh --interactive
Topology
| Instance | Role | Address | Users |
|---|---|---|---|
| IdP | SAML2 Identity Provider | http://127.0.0.1:8090 | alice (admin), carol (user) |
| SP | SAML2 Service Provider | http://127.0.0.1:8091 | bob (admin) |
Ports default to 8090/8091; override with DEMO_PORT=<base>.
What the script does
- Starts the IdP and SP instances with random passwords.
- Fetches the IdP’s SAML2 metadata and extracts the X.509 signing certificate.
- Registers the IdP as an upstream at the SP (including the certificate for signature verification).
- Registers the SP at the IdP (with the SP’s ACS URL).
- Logs in at the IdP as
aliceand initiates the SSO flow from the SP. - Verifies that the SP’s ACS accepts the signed SAMLResponse and creates a session.
- Tests SP-initiated SLO and verifies session revocation.
- Checks audit logs for SAML2 events.
Interactive exploration
In --interactive mode, the script prints the URLs and credentials and waits
for Ctrl-C. You can:
- Browse the IdP metadata:
http://127.0.0.1:8090/saml2/metadata - Browse the SP metadata:
http://127.0.0.1:8091/saml2/sp/metadata/partner-idp - Start the SSO flow:
http://127.0.0.1:8091/saml2/auth/partner-idp(log in at the IdP first, then follow the redirects) - Initiate SLO:
http://127.0.0.1:8091/saml2/slo/start/partner-idp - Inspect audit events in the log files printed at startup.
Configuration files
| File | Purpose |
|---|---|
contrib/demo/saml2/idp.toml | IdP configuration (SAML2 idp_enabled) |
contrib/demo/saml2/sp.toml | SP configuration (SAML2 sp_enabled) |
contrib/demo/saml2/users-idp.toml.in | IdP user template |
contrib/demo/saml2/users-sp.toml.in | SP user template |