I'm building a SAAS web app in PHP that needs to integrate SSO. We'll have multiple client organizations, each that have their own Identity Provider (Active Directory). While researching possibilities, I came across SimpleSAMLphp, but I'm not sure it will fulfill my requirements and would like feedback on best approach for implementation. Seems like SAML or Kerberos is the way to go, but I have limited experience in this area.
Need these abilities:
- Client Admins should be able to add and remove access to our app via AD.
- Authenticate user with their respective AD Server (flexibility for authenticating with others a big plus) - Other than depending on static IPs how can I know which Identity Provider to check?
- Users of organizations that do not have an Identity Provider should be able to login through the existing authentication method (hashed pass in mysql).
Additional info: I'm planning to host the PHP app on a CentOS server. We do have the capability of connecting a site-to-site VPN if required...Added this question over on stackoverflow, no responses there, hoping some server admins here might have some insight.
UPDATE: Also, we'll have an IONIC hybrid app (ios/android) that will need to have SSO - at this point I have no idea how that will tie in. The mobile app will be communicating through a REST api, developed in PHP.