Claims Transformation - SAML and OIDC | Recipes | Strata.io

Name: Claims Transformation - SAML and OIDC | Recipes | Strata.io
Ingredients: 1 User requests a protected application (which is expecting an OIDC exchange).; 2 User's session is redirected to the Maverics Orchestrator.; 3 Maverics will evaluate if a valid session exists with your Authentication provider of choice (GCP's IAP in this case)./; 4 If the user hasn't authenticated yet - Maverics will redirect the user to properly authenticate using Google's identity provider.; 5 [optional] Google's IAP performs whatever zero trust checks it deems appropriate for the user.; 6 IAP sends a SAML assertion to Maverics.; 7 Maverics consumes the SAML token and parses it's assertions.; 8 [optional] Maverics can grab other attributes from other places for richer policy enforcement or additional claims.; 9 Maverics provides an auth code to the user's session and redirects to the target application.; 10 Target application exchanges the auth code directly with Maverics to validate.; 11 User is granted access to the application.

www.strata.io

Extend your IAM investment into apps with claims transformation without rewriting application code to accept new identity standards or protocols.

View Original

Share this recipe:

Ingredients

1 User requests a protected application (which is expecting an OIDC exchange).
2 User's session is redirected to the Maverics Orchestrator.
3 Maverics will evaluate if a valid session exists with your Authentication provider of choice (GCP's IAP in this case)./
4 If the user hasn't authenticated yet - Maverics will redirect the user to properly authenticate using Google's identity provider.
5 [optional] Google's IAP performs whatever zero trust checks it deems appropriate for the user.
6 IAP sends a SAML assertion to Maverics.
7 Maverics consumes the SAML token and parses it's assertions.
8 [optional] Maverics can grab other attributes from other places for richer policy enforcement or additional claims.
9 Maverics provides an auth code to the user's session and redirects to the target application.
10 Target application exchanges the auth code directly with Maverics to validate.
11 User is granted access to the application.