What to do after SAML assertion is returned to service provider?

Question

my team is building a healthcare React application and we are using Auth0 for authentication. We are required to have SAML integration for healthcare institutions.

I have set up the Assertion Consumer Service endpoint in our application. I have set up a Keycloak instance as our internal test IDP. Right now, it is able to receive SAML responses with the assertion from the test IDP.

From here on, I’m not sure what to do next. I have read that I can request an auth token using the SAML assertion. When I try invoking this command:

curl -X POST “/oauth/token” -H “Content-Type: application/x-www-form-urlencoded” -d "grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer&assertion=<64 base encoded assertion>

I get " {“error”:“unauthorized_client”,“error_description”:“Grant type ‘urn:ietf:params:oauth:grant-type:saml2-bearer’ not allowed for the client.”,“error_uri”:“”}"

What am I doing wrong? Thanks!

docs.oasis-open.org/security/saml/Post2.0/… is a good read to start with — identigral
– identigral, Commented May 23 at 21:01

grawity · Accepted Answer · 2025-05-28 12:47:48Z

0

From here on, I’m not sure what to do next. I have read that I can request an auth token using the SAML assertion. When I try invoking this command:

The SAML assertion is the token (although it is more like an ID token than an access token).

Your app itself is already the destination or "audience", so you can't forward the SAML assertion anywhere else; you're its sole consumer.

What you do next is use a SAML library to validate its signature (against the IdP certificate), then parse it as XML to extract the asserted attributes (e.g. user ID, email address, full name, etc). Use one of those attributes (typically 'subject-id') to map the session to your internal user database, and/or use other attributes (like 'groups') to directly determine user roles.

After that, your ACS endpoint can issue some kind of auth token (of your own choice) for your JS app to use.

edited May 28 at 12:47

answered May 24 at 14:26

grawity

20.1k3 gold badges40 silver badges63 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

What to do after SAML assertion is returned to service provider?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related