SAML support?

[pac78275]

Does Ansible Semaphore currently support SAML? Are there any plans to add it if not?

[cf-sewe]

I personally wouldn't add this complexity to a Open Source solution. Its hard to implement, test, and maintain.
But what about using an Authentication Proxy, like Pomerium?

If you want to use the authenticated user object in Semaphore, a rather small feature request could do that.
Basically Semaphore would evaluate the user from a configurable HTTP header.
See:

• https://www.pomerium.com/docs/topics/getting-users-identity
• https://www.pomerium.com/docs/topics/original-request-context.

[tboerger]

It is not planned to integrate SAML support. I would suggest to use the OIDC integration instead.

[blakeduffey]

It is not planned to integrate SAML support. I would suggest to use the OIDC integration instead.

OIDC isn't SAML. SAML is the defacto standard and is better supported by commercial IdPs, etc.

[tboerger]

Idps like keycloak could act as a proxy which provides proper mapping between oidc and saml.

Saml is a protocol that's used within enterprises only. There are options to proxy this.

It's simply hard to implement it right and to properly test it in an automated way.

[blakeduffey]

I'm sure there are ways to make such a thing work. But I'm not sure why I should be asked to implement some sort of proxy (additional time, cost, and complexity). to support the industry standard. SAML is certainly not only used 'within' an enterprise - IdP like Okta, commercial offerings like Microsoft or Tenable. Is Ansible/Semaphore not really an enterprise tool? Should we be looking for alternatives?

[tboerger]

This industry standard is not widely used outside of big corporations. There are much more modern standards widely used these days like OAuth2/OIDC.

If you need to connect an AD you can use the LDAP integration (which is already a pain because there are quite often configuration issues posted here).

You are asking a small opensource project to implement and longterm support an ancient standard while you are not willing to use/integrate some proxy like keycloak because it's a maintenance burden 👍

Even IdPs like Dex are deprecating the saml integration because nobody wants to maintain it: https://dexidp.io/docs/connectors/saml/

[blakeduffey]

Thank you for your time.