Apache Sling SAML2 Handler

An OSGi bundle that provides a SAML2 Web Profile Service Provider Authentication for Apache Sling using OpenSAML v4 libraries

Overview

The SAMLRequest uses HTTP Redirect Binding, and the contained Authn Request object instructs the IDP to use HTTP Post Binding.

Sling applications may authenticate users against an Identity Provider (idp) such as Keycloak Server or Shibboleth IDP.

User management is based on the OSGi bundle configuration and SAML2 Assertion

Upon successful authentication, a user is created
The user may be added to a JCR group membership under certain conditions:
- This bundle has an OSGI config saml2groupMembershipAttr set with the value of the name of the SAML group membership attribute.
- The users SAML assertion contains an attribute matching the configuration above
- The value of the users group membership attribute is a name of an existing JCR group
syncAttrs can be used to synchronize user properties released by the IDP for profile properties such as given name, family name, email, and phone.

Set up the system user “saml2-user-mgt”