SAML SSO Demo with a Test Identity Provider
Service-provider login against a local SAML test IdP, with signed assertions and clock-skew handling.
- Runs out of the box: yes
- Tests: no
- CI: no
- Docs: yes
- Used in production: no
Learning demo, not turnkey. This example is experimental: it shows an idea that works on the bench, but it has not been reviewed for production use. Expect rough edges and check with the owner before reusing it.
Purpose#
A throwaway service provider that exercises the SAML 2.0 web browser SSO profile against a test identity provider running in a container. It validates the assertion signature, audience and time window, then creates a local session.
It exists to learn where SAML integrations usually break (certificate rotation, clock skew, attribute naming) before committing to a production design. It is not hardened and has no role mapping yet.
Technologies & features#
- Technologies
- PythonFastAPISAMLDocker
- Features
- SAML Single Sign-OnSingle Sign-On
- Topics
- Federated Identityprimary
Lessons learned#
- Didn’t work
Assertions were rejected whenever the test IdP container clock drifted. A configurable skew of 60 seconds fixed the demo; production needs time sync checked at startup.
- Note
Attribute names differ per identity provider. The demo keeps a small mapping file instead of hard-coding the first IdP's names.
Try it#
git clone https://git.example.internal/business-systems/saml-sp-demo.git
cd saml-sp-demo
docker compose up
# open http://localhost:8000 and choose "Sign in with test IdP"Commands come from the owner’s README. Credentials are never stored here.
