Styjun

In my Ruby on Rails project I need to implement SAML SSO with Ping Identity as my IDP. The gem I'm using is devise_saml_authenticatable

In my config/initializers/devise.rb I have:

config.saml_route_helper_prefix = 'saml'
 # ==> SAML
 config.saml_create_user = true
 config.saml_update_user = true
 config.saml_default_user_key = :email
 config.saml_session_index_key = :session_index
 config.saml_use_subject = true
 config.idp_entity_id_reader = DeviseSamlAuthenticatable::DefaultIdpEntityIdReader
 config.idp_settings_adapter = nil

 config.saml_configure do |settings|
 settings.assertion_consumer_service_url = "#Settings.devise_callback/users/saml/auth"
 settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
 settings.name_identifier_format = Settings.clientname.sso.name_identifier_format
 settings.issuer = "#Settings.devise_callback/users/saml/meta_data"
 settings.idp_entity_id = Settings.clientname.sso.idp_entity_id
 settings.authn_context = ""
 settings.idp_slo_target_url = Settings.clientname.sso.idp_slo_target_url
 settings.idp_sso_target_url = Settings.clientname.sso.idp_sso_target_url
 settings.idp_cert_fingerprint = Settings.clientname.sso.idp_cert_fingerprint
 settings.idp_cert_fingerprint_algorithm = 'http://www.w3.org/2000/09/xmldsig#sha256'
 end

In my app/models/user.rb I have

devise :database_authenticatable, :rememberable, :trackable, :validatable, :recoverable, :timeoutable, :session_limitable, :saml_authenticatable

Apart from using my client's IDP, I've set up IDPs using Onelogin and Okta and the above code work perfectly fine.

Unlike Onelogin and Okta, my client's IDP offered by Ping Identity does not first show you the page for entering your email, then another page for enetering your password. In otherwords, no IDP login page like Onelogin and Okta.

So the question is, right now I have the client's IDP's entity id, SSO target URL, SLO target URL, fingerprint. How to I authenticate to the IDP via a form and log user in?

So far I've tried

=form_tag(Settings.sso.idp_sso_target_url, html: role: 'form', method: :post) do |f|
 .form-group
 label for="email" Email
 = email_field_tag :email
 .form-group
 label for="password" Password
 = password_field_tag :password
 button.btn.btn-info.btn-sm type="submit" Submit
 |  

where Settings.sso.idp_sso_target_url is the SSO target url that looks like https://auth2test.clientname.ca/idp/SSO.saml2

With Ping as IDP, I got this:

<S11:Envelope><S11:Body><S11:Fault><faultcode>soapenv:Client</faultcode><faultstring>Invalid Request</faultstring></S11:Fault></S11:Body></S11:Envelope>

Then I tested using Onelogin as IDP, it just redirected me to the page where I input my email.

I've also tried

 = form_for(resource, as: resource_name, url: saml_user_session_path(resource_name), html: role: 'form') do |f|
 .form-group
 label for="email" Email
 = f.email_field :email, autofocus: true, autocomplete: "email", class: 'form-control', placeholder: 'Email', id: 'email'
 .form-group
 label for="password" Password
 = f.password_field :password, autocomplete: "off", placeholder: 'Password', class: 'form-control', id: 'password'
 button.btn.btn-info.btn-sm type="submit" Submit
 |  

This one is giving error Invalid email or password (I'm sure that's correct).

I highly doubt that I'm on the right track. Please point me to the correct direction. Thank you very much!