Requirements for setting up Laravel app as an identity provider

[alexschema]

Hi there 👋

I was looking into setting up an existing Laravel application as an IdP and I had some questions.
Essentially, I want the Laravel app to act as an external IdP, and have AWS IAM Identity Center use the app to sign in to the AWS access portal. It would be similar to how an external IdP like Okta can be setup so existing Okta credentials can be used to sign in to AWS. I'm new to doing this, I'm sorry in advance if I'm overexplaining or leaving out important info haha.

I saw in the AWS documentation that to setup other identity providers, they have special considerations to consider.

Any identity provider (IdP) that implements these standard protocols is expected to interoperate successfully with IAM Identity Center, with the following special considerations:

SAML

• IAM Identity Center requires a SAML nameID format of email address (that is, urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress).
• The value of the nameID field in assertions must be an RFC 2822 (https://tools.ietf.org/html/rfc2822) addr-spec compliant (“name@domain.com”) string (https://tools.ietf.org/html/rfc2822#section-3.4.1).
• The metadata file cannot be over 75000 characters.
• The metadata must contain an entityId, X509 certificate, and SingleSignOnService as part of the sign-in URL.
• An encryption key is not supported.

SCIM

• The IAM Identity Center SCIM implementation is based on SCIM RFCs 7642 (https://tools.ietf.org/html/rfc7642), 7643 (https://tools.ietf.org/html/rfc7643), and 7644 (https://tools.ietf.org/html/rfc7644), and the interoperability requirements laid out in the March 2020 draft of the FastFed Basic SCIM Profile 1.0 (https://openid.net/specs/fastfed-scim-1_0-02.html#rfc.section.4). Any differences between these documents and the current implementation in IAM Identity Center are described in the Supported API operations section of the IAM Identity Center SCIM Implementation Developer Guide.

Does Laravel SAML IdP follow the special considerations outlined in the documentation?
Would the SAML section from the excerpt above be something that I would enforce in my app or are any of those checks supported by the package?

Any help is appreciated, thanks!

[upwebdesign]

@alexschema I dont have a lot of AWS IAM experience. This package is a Laravel wrapper for litesaml/lightsaml. Your question, although nicely articulated, may be better placed in their https://github.com/litesaml/lightsaml/issues. There may be someone there that can answer your question. You may keep your question here for discussion and update as you find further information. It would be greatly appreciated.

[alexschema]

Okay I'll submit my question there, thank you. 🙂