We are trying to convert an existing web app, which uses our custom auth (essentially a user/pass validated against our own sql db) into an SSO version.
We've already converted it to one that relies on IdP initiated SAML 2.0, and that wasn't much trouble at all. We reference a third party library and on our login page we have code that receives and validates/processes the SAML Response against a locally stored x509 cert. From the SAML we pull out a username and then validate that to our existing sql db. If that is valid, we allow the user access. If either that is invalid or the SAML received is invalid, we simply redirect to the external SSO login site, run by another party. We then set our own auth and check that on all other pages of the site, so if anyone tries to directly go to one of those, it will be intercepted and redirect them to the third party SSO login site.
We want to implement essentially the same thing again, but need to receive ...
Go to the complete details ...