Is the current state of affairs any better for SAML identity providers? I need to integrate SSO into our app and am also worried about having to write custom code for every identity provider we want to support.
You could integrate with something like Ping Federate. Then customers configure their identity provider to connect to your Ping Federate instance. I've seen the workflow for the support team to enable customers and it's not terribly difficult with the usual issues around expired certificates. Weird customers can be outsourced to Ping Federate support for guidance.
If an IdP is SAML compliant, you only need to write code once. Of course, if you also want to authz based on IdP roles, you will need to have a mapper (from your app perms to IdP roles), but this is not because of differences in IdP
Comments
Is the current state of affairs any better for SAML identity providers? I need to integrate SSO into our app and am also worried about having to write custom code for every identity provider we want to support.
You could integrate with something like Ping Federate. Then customers configure their identity provider to connect to your Ping Federate instance. I've seen the workflow for the support team to enable customers and it's not terribly difficult with the usual issues around expired certificates. Weird customers can be outsourced to Ping Federate support for guidance.
If an IdP is SAML compliant, you only need to write code once. Of course, if you also want to authz based on IdP roles, you will need to have a mapper (from your app perms to IdP roles), but this is not because of differences in IdP
SAML in my (anecdotal) experience seems to be worse, if it's supported at all.
Most IdPs support SAML IIRC
We've been quite happy with Auth0 to solve this problem.
Auth0 is just another IDP, no? Could you elaborate?
Auth0 can be used as the SP as well.
https://auth0.com/docs/authenticate/protocols/saml/saml-sso-...
SAML delenda est