{"action":"created","issue":{"url":"https://api.github.com/repos/dexidp/dex/issues/1282","repository_url":"https://api.github.com/repos/dexidp/dex","labels_url":"https://api.github.com/repos/dexidp/dex/issues/1282/labels{/name}","comments_url":"https://api.github.com/repos/dexidp/dex/issues/1282/comments","events_url":"https://api.github.com/repos/dexidp/dex/issues/1282/events","html_url":"https://github.com/dexidp/dex/pull/1282","id":356285784,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEyNTk0OTA4","number":1282,"title":"SAML Artifact Binding Support","user":{"login":"amdonov","id":712980,"node_id":"MDQ6VXNlcjcxMjk4MA==","avatar_url":"https://avatars2.githubusercontent.com/u/712980?v=4","gravatar_id":"","url":"https://api.github.com/users/amdonov","html_url":"https://github.com/amdonov","followers_url":"https://api.github.com/users/amdonov/followers","following_url":"https://api.github.com/users/amdonov/following{/other_user}","gists_url":"https://api.github.com/users/amdonov/gists{/gist_id}","starred_url":"https://api.github.com/users/amdonov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amdonov/subscriptions","organizations_url":"https://api.github.com/users/amdonov/orgs","repos_url":"https://api.github.com/users/amdonov/repos","events_url":"https://api.github.com/users/amdonov/events{/privacy}","received_events_url":"https://api.github.com/users/amdonov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"ericchiang","id":2342749,"node_id":"MDQ6VXNlcjIzNDI3NDk=","avatar_url":"https://avatars1.githubusercontent.com/u/2342749?v=4","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},"assignees":[{"login":"ericchiang","id":2342749,"node_id":"MDQ6VXNlcjIzNDI3NDk=","avatar_url":"https://avatars1.githubusercontent.com/u/2342749?v=4","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2018-09-02T14:14:32Z","updated_at":"2018-09-05T02:11:31Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/dexidp/dex/pulls/1282","html_url":"https://github.com/dexidp/dex/pull/1282","diff_url":"https://github.com/dexidp/dex/pull/1282.diff","patch_url":"https://github.com/dexidp/dex/pull/1282.patch"},"body":"This issue relates to #1045. The Artifact Binding is very much like the oauth 2 server-side flow and can be implemented as a redirect connector if RelayState is an acceptable state query parameter in addition to state. Unlike the redirect Binding the SAML assertion isn't limited by query size. Another nice feature is that it is retrieved directly from the IdP and is more secure. The go SAML library currently used in dex doesn't support Artifact Binding. This one includes an alternative that I wrote that has been used in production for some time. I didn't vendor it in this commit.\r\n\r\nI'd like this to be included as an experimental alternative to the existing SAML connector for others to try out."},"comment":{"url":"https://api.github.com/repos/dexidp/dex/issues/comments/418576442","html_url":"https://github.com/dexidp/dex/pull/1282#issuecomment-418576442","issue_url":"https://api.github.com/repos/dexidp/dex/issues/1282","id":418576442,"node_id":"MDEyOklzc3VlQ29tbWVudDQxODU3NjQ0Mg==","user":{"login":"amdonov","id":712980,"node_id":"MDQ6VXNlcjcxMjk4MA==","avatar_url":"https://avatars2.githubusercontent.com/u/712980?v=4","gravatar_id":"","url":"https://api.github.com/users/amdonov","html_url":"https://github.com/amdonov","followers_url":"https://api.github.com/users/amdonov/followers","following_url":"https://api.github.com/users/amdonov/following{/other_user}","gists_url":"https://api.github.com/users/amdonov/gists{/gist_id}","starred_url":"https://api.github.com/users/amdonov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amdonov/subscriptions","organizations_url":"https://api.github.com/users/amdonov/orgs","repos_url":"https://api.github.com/users/amdonov/repos","events_url":"https://api.github.com/users/amdonov/events{/privacy}","received_events_url":"https://api.github.com/users/amdonov/received_events","type":"User","site_admin":false},"created_at":"2018-09-05T02:11:31Z","updated_at":"2018-09-05T02:11:31Z","author_association":"NONE","body":"Sure, reasonable question. However, I think most of the hassles associated with SAML are related to the POST binding which I try to avoid. Outside of that the flow is pretty much like OAuth with more complicated messages. \r\n\r\nI have a client with a highly customized SAML IdP. They want to move towards OIDC/OAuth for obvious reasons, but they don't want to break existing applications. Adding dex do their environment and integrating via SAML minimizes their need for change. They prefer Artifact Binding to POST for a couple of reasons. 1) If someone links to an image on their page they can login them in with redirects alone. POSTs don't work for those types of resources 2) Scripting clients is easier for them because code just has to accept cookies and follow redirects.\r\n\r\nMy hope was to get this accepted by either including the SAML library that we use or updating the one you use.\r\n\r\nNext step would be to add SAML Attribute Query to allow refresh."}}
{"actor":{"display_login":"amdonov"}}