Blog | G5 Cyber Security

Service Provider to Identity Provider Communication

G5 Cyber Security

TL;DR

Yes, a service provider (SP) can communicate directly with an identity provider (IdP), but it’s usually done through standard protocols like SAML, OAuth 2.0, or OpenID Connect. Direct communication isn’t about SP calling IdP APIs directly for every user; it’s about establishing trust and exchanging security information.

Understanding the Players

Before we dive in, let’s clarify what each part does:

How Communication Happens

SPs don’t typically make direct API calls to IdPs for every single user action. Instead, they use protocols designed for secure identity management.

1. SAML (Security Assertion Markup Language)

  1. User Request: You try to log in to a service provider.
  2. Redirection: The SP redirects you to the IdP.
  3. Authentication: You log in at the IdP (e.g., enter your username and password).
  4. Assertion: The IdP creates a SAML assertion – a secure statement about your identity.
  5. Response: The IdP sends this assertion back to the SP.
  6. Access Granted: The SP trusts the assertion (if it’s valid) and lets you in.

SAML relies on XML-based messages exchanged between the SP and IdP.

<saml2:Assertion ...>

2. OAuth 2.0 & OpenID Connect

  1. User Request: You try to log in using a social provider (e.g., Google).
  2. Authorization Request: The SP redirects you to the IdP’s authorization endpoint.
  3. Authentication & Consent: You authenticate with the IdP and grant permission for the SP to access certain information.
  4. Authorization Code: The IdP sends an authorization code back to the SP.
  5. Token Exchange: The SP exchanges this code for an access token (and often a refresh token).
  6. API Access: The SP uses the access token to call the IdP’s APIs on your behalf.

OAuth 2.0 is primarily about authorization, while OpenID Connect adds identity information on top of OAuth 2.0.

POST /token HTTP/1.1

3. SCIM (System for Cross-domain Identity Management)

  1. Provisioning: When a new user is created in the SP, it can automatically create an account in the IdP using SCIM.
  2. Deprovisioning: When a user is deleted from the SP, it can automatically delete the account in the IdP.
  3. Attribute Updates: Changes to user information (e.g., name, email) can be synchronized between the SP and IdP.

SCIM uses RESTful APIs for managing user accounts.

PUT /Users/{id}

Security Considerations

Exit mobile version