Multiple SAML IDP

[chunkyen]

Hi, is multiple SAML IDP supported in Cloudstack 4.22? From the Global config, there is only the ability to add a single URL to saml2.idp.metadata.url, but the fact that you can put a saml2.default.idpid suggest that there can be more than one idp provider. The documentation also suggested placing certain idp xml on /etc/cloudstack/management folder of the mangement server but does not go into details on how this should be done.

I have also read discussion https://github.com/apache/cloudstack/discussions/11105#discussioncomment-13614691 but am still clueless on the exact steps.

Help will be appriciated. Thanks

[DaanHoogland]

@chunkyen , as of now the saml2 settings are all global so work needs to done to make it tenant configurable (afaik).

[chunkyen]

Thank you @DaanHoogland, I know this is a global setting but was hoping there is a way to have multiple SAML IDP. I also don't need this to be Domain specific, as the ability to authorize a user account to use a specific SAML SSO IDP is already there.

[kiranchavala]

@chunkyen The setting "saml2.idp.metadata.url" can contain multiple multiple IDPs defined

Please refer to the following discussion

#11105 (comment)

[chunkyen]

Hi, I have read that thread before but couldn't find a way to add multiple idp for saml. Do I add url1, url2 to saml2.idp.metadata.url?

[rajujith]

@chunkyen

CloudStack does support federated SAML logins, which means if there’s a SAML deployment with multiple IDPs defined in the metadata or XML CloudStack picks that, and it shows up as a drop-down list when logging in or authorising account users. In case of multiple IDPs, the default Idp should be defined in a related global setting.

The design doc has some details:
https://cwiki.apache.org/confluence/plugins/viewsource/viewpagesrc.action?pageId=75968390

Here’s an example of IDP metadata with multiple IDPs https://ds.cafeexpresso.rnp.br/metadata/ds-metadata.xml

cc: @yadvr