Master SAML 2.0 with Okta

Explore the fundamentals of identity management, including identity, authentication, authorization, and provisioning, then examine LDAP and delegated authentication to build intuition for SAML.

Explore how a monolithic web application handles authentication and authorization in a custom security architecture, with identity as the source of truth and credentials verified against the app database.

Explore how authorization uses roles to restrict actions, enforce server-side checks, and support identity provisioning within a database-driven architecture.

Identify the problems of a monolithic security architecture, including duplicated user identities, multiple passwords, heavy provisioning, no single sign-on, and passwords sent to applications.

Move user identity outside applications into a common identity service to enable shared credentials, centralized provisioning, and role-based access via an enterprise directory like Active Directory.

Explore LDAP fundamentals, learn how directory services like Active Directory organize data hierarchically, and perform bind, search, add, modify, and delete using universal LDAP libraries.

Centralize user identities with ldap and Active Directory, move provisioning to the directory service, and integrate web applications via ldap authentication and session management.

Examine the ldap architecture's downsides, where credentials travel to the web app via post requests and basic authentication, risking exposure and hindering delegated authentication in cloud deployments.

Master delegated authentication with SAML 2.0 by learning how a web app redirects to a trusted identity management system for cross-domain login.

Master SAML 2.0 concepts for cloud authentication by exploring identity provider, service provider, and SAML metadata, then compare SP-initiated and IdP-initiated single sign-on flows.

Learn the basics of SAML 2.0 and XML-based messages, and how identity management systems enable delegated authentication and single sign-on through service providers and identity providers.

Describe the SAML architecture and the SP initiated single sign-on flow, including metadata exchange. Trace how the user, identity provider, service provider, and directory services interact.

Explore SAML 2.0 with Okta by creating a developer account and a SAML application, then send a signed SSO request. Analyze the response, signatures, cryptography basics, and debugging tools.

Sign up for an Okta developer account, create a SAML application, manage users and groups, and review metadata to establish a trust between identity provider and service provider.

Learn to debug SAML using browser tools such as Chrome devtools and the SAML DevTools extension to inspect requests and responses between the browser, SAML service provider, and identity provider.

Explore setting up a saml sso flow with Okta, manually constructing and encoding a saml request, inspecting responses with Chrome, and debugging with dev tools.

Install Python 3.10 and run a CGI-enabled web server for the SAML dummy app, then use the CGI script to post or get the SAML assertion via the ACS URL.

Create a SAML 2.0 integration in the Okta developer console, configure the ACS URL, audience entity ID, and attributes, and assign a user to generate the SAML metadata.

Compress and encode the SAML request with deflate, base64, and URL encoding; construct the SSO URL, and observe the decoded SAML response in the browser with Okta.

Explore SAML SSO by examining the response and assertion signatures (RSA-SHA256) and fields like destination, InResponseTo, issuer, status, subject, and attributes such as first name and last name.

Validate the saml assertion and response by checking destination, inresponseto, issuer, recipient, and audience, and verify the signature with the idp public certificate using sha-256.

Explore how tampering with a SAML response alters the nameID and causes signature verification to fail, while expiration and timing checks defend against replay attacks.

Explore XML encryption of SAML assertions, add groups and user-defined attributes, and map the nameID to UID instead of email, using debugging tools to analyze requests and responses.

Create a new uid attribute in Okta's profile editor, set it as a unique user identifier, and establish three project-scoped groups (read only, readwrite, admin) for SAML authorization.

Create an Okta saml 2.0 integration for project-2 on port 8081, configuring the acs url, entity id, and username from userId, with group claims and signed, encrypted assertions and assignments.

Create and send a SAML request to the IDP using the template, encode with deflate, base64, and URL encoding, then inspect the SAML response and its encrypted data.

Explore how the IDP encrypts the SAML assertion for Okta via XML Encryption with AES256-CBC, RSA-wrapped keys, and EncryptedData, EncryptedKey, and KeyInfo in hybrid encryption.

Verify and decrypt a SAML response to reveal the encrypted assertion, using the private key to obtain the decrypted XML, inspect issuer, subject, audience, auth context, attributes, and group claims.

Explore SAML logout workflows by crafting a single logout request to the IdP, analyzing logout responses, and examining HTTP sessions, user provisioning, and adding multifactor authentication in Okta.

Explore how single logout works in SAML with Okta, including IDP and application sessions, SP initiated logout, and the challenges of destroying all active sessions.

Explain the SP-initiated single logout flow in Okta, where the app signs a logout request to the IDP and validates the signed response, leaving other apps unaffected.

Enable single logout in the SAML app and configure the logout URL. Create a signed logout XML request with the private key, send it to the IDP, and verify response.

Enable single logout in Okta by configuring the SLO URL. Create SAML logout request and review identity provider metadata for SLO service with HTTP post or HTTP redirect bindings.

Create and sign a SAML logout request manually using a template, configuring issuer, nameID, session index, and the IDP logout URL with the private key via SAML developer tools.

Encode and send the SAML logout request to the IDP, including the SAML request, signature algorithm RSA-SHA1, signature, and relay state, then validate the logout response.

Examine how Okta manages SAML single sign-on and logout through cookies, SID session cookies, and relay state to control IDP sessions.

Explore how Okta provisions users within an identity management system, assign them to SAML apps, and manage IDP-initiated single sign-on from an enterprise dashboard.

Learn how Okta MFA integrates with SAML 2.0, enabling multifactor authentication for applications without code changes. The lecture demonstrates configuring email-based MFA, sign-on policies, and seamless user login.

Learn how spring security protects a form-based spring boot car portal, featuring role-based access for cars.user and cars.admin, with login, buy and edit actions, and authentication versus authorization concepts.

Learn how a Spring Boot form login app for a used car portal uses Spring Security with in-memory users and role-based access to list and buy cars.

Demonstrate securing a Spring Boot cars online app with saml authentication via Okta, delegating login to Okta and showing role-based permissions and single logout.

Walk through integrating SAML with Spring Boot and Okta using the spring-security-saml2-service-provider, configure saml2Login and saml2Logout, and map groups to authorities via application.yml and metadata.

Configure saml 2.0 in a spring boot app with Okta by setting acs url, single logout url, entity id, and metadata url, plus cars.user and cars.admin groups for roles.

Discover why identity brokers are required and how they enable multi-protocol SSO across SAML, OpenID Connect, and social providers, then set up an Okta broker for your cards online application.

Learn how identity brokers unify diverse identity providers and protocols, enabling SAML, OpenID Connect, and other identity management systems to work together without complex per-vendor configurations.

Explore how identity brokers bridge SAML and OpenID Connect, enabling just-in-time provisioning and dynamic user provisioning across IDMs while keeping the application SAML-centric.

Demonstrate configuring a SAML application in Okta and implementing an identity broker to let Car Mantra employees access the cars online portal without code changes.

Configure a Saml 2.0 identity provider in Okta to broker login between the used car portal and car mantra, set routing rules, mappings, and just-in-time provisioning.

Set up the car mantra as the identity provider by creating users and groups, configuring a SAML 2.0 cars online application, and sending group attributes and user IDs in assertions.

Update the identity provider in the used car portal on Okta by replacing the fake certificate with the downloaded certificate and the correct IDP issuer, then complete the Carmenta integration.

Learn to implement and test saml 2.0 with Okta for a car online application, covering identity provider routing, single sign-on, and role-based access.

Consolidate your SAML 2.0 knowledge by reviewing identity provider and service provider concepts, cryptography basics, and Okta-based integration through Java Spring Boot and SAML flows.

Explore the basics of encoding and cryptography, including URL encoding, Base64, hashing, encryption, and digital signatures, and compare AES and RSA to understand their use in SAML and OAuth.

Learn why URL encoding is needed to safely transmit URL paths and parameters in http get or post requests, and how spaces and special characters are encoded and decoded.

Explore base64 encoding to convert binary data into text for embedding in HTML, CSS, or XML for SAML contexts. Decode base64 to recover the original data; base64 is not encryption.

Explore how cryptographic hashing converts any data to a fixed-size, unique, non-reversible digest. Apply SHA-2 algorithms and salt-based password storage for authentication and file integrity checks.

Master symmetric encryption by transforming data with a secret key and a known algorithm, using AES 256 or AES 512, and recognizing the key distribution problem between Alice and Bob.

Explore RSA asymmetric encryption, where private and public keys enable encryption, decryption, and digital signatures; learn how public key certificates and certificate authorities verify key ownership.

Explore how hybrid encryption combines AES-256 for data with RSA public-key encryption for the secret key, enabling secure SAML messages sent with Okta.

Explore how digital signatures use private keys to sign a SHA256 hash, enabling verification with a public key in SAML exchanges, including RSA basics.

Demonstrate base64 encoding and decoding, URL encoding and decoding, and hashing with OpenSSL, including sha-256 and sha-512, plus the importance of salted hashes to resist dictionary attacks.

Explore symmetric encryption with OpenSSL enc, generating a secret key via pbkdf2 and sha1, encrypting and decrypting data (text and files), with base64 and URL encoding options.

Demonstrate rsa-based asymmetric encryption with openssl by generating private and public keys for Alice and Bob and performing encryption and decryption to illustrate key pairs.

Demonstrates hybrid encryption with OpenSSL by generating a secret key, encrypting data with AES-256, and securing the passphrase with RSA.

Demonstrates signing a file by hashing with sha-512 and RSA private key. Shows how to base64 encode the signature and verify it with the public key via OpenSSL.