
### How to use Single Sign-On for your ASP.NET MVC application? {#how to use single-sign-on for ASP.NET MVC application}

There may come a time when you need to implement Single Sign-On onto your ASP.NET MVC application. It allows you to integrate your app with other systems and helps them work together as if they are one unified application.

Some of the benefits of doing this are an improved user experience, increased security, and reduction in costs. Users will be able to seamlessly access pages on any of these applications or systems after signing in only once.

Or, if you want to migrate your application, rather than having to rewrite it entirely, you can migrate it one service at a time. Implementing SSO between the two applications helps you effectively link them together as if they were one, after which you can migrate your app with ease. There are even more advantages discussed later in this article.

To understand how you can implement ASP.NET MVC Single Sign On, let us first understand what its components mean.

### What is ASP.NET MVC? {#what is ASP.NET MVC}

ASP.NET MVC is composed of two parts: ASP.NET and MVC. The first is an open-source web application framework that can be used to produce dynamic web pages, applications, and services. The second is MVC, which stands for Model View Controller. It is an architectural pattern that is meant to achieve separation of concerns. 

Together, they form a web application framework that eliminates the drawbacks of web forms like slow response times, issues in unit testing, and HTML customization.

Designing your application using the ASP.NET MVC framework allows you to benefit from both its components’ advantages. However, you still need to make it easier for users to sign in to your application and avail of its services in a hassle-free manner. Let’s see how we can do that.

 ### What is SSO? {#what is SSO}

 When a user wants to access secured services on your application, they have to enter their username and password once to authenticate themselves. In a situation where they want to access similar services over multiple applications connected or related to each other, they would be required to enter either the same or different usernames and passwords multiple times.

 ![what-is-single-sign-on-and-how-sso-works-4](/blog/assets/2023/what-is-single-sign-on-and-how-sso-works-4.webp)

 Single Sign-On (SSO) makes this process easier by using the same authentication ID and authorizing the user across multiple services. Because of SSO, as the name suggests, the user is required to sign in only once in a certain time window before the authentication token expires.

 ### What are the types of SSO protocols? {#what are the types of SSO protocols}

 For SSO to work, Service Providers (SP) and Identity Providers (IDP) must decide on an open standard protocol for how they will choose to exchange identity and authentication information with one another over the relevant applications.

 Here are a few examples of these protocols: 

 **OAuth**: This is an open standard for token-based authentication and authorization, which is used to provide Single Sign-On (SSO). It allows an end user’s account information to be used by third-party services without exposing the user’s password. It serves as an intermediary on behalf of the end-user, providing the service with an access token that authorizes specific account information to be shared.

 **OpenID**: This is one of the most popular authentication protocols, used by the likes of Google and Facebook. It is open standard and decentralized. Third-party Identity Providers (IdP) are used to authenticate users to Relying Parties (RP). It serves as an identity layer on top of OAuth, thereby functioning as an extension to it.

 **SAML**: SAML uses session cookies in a browser that allows a user to access certain pages. It gives more control to enterprises to keep their SSO logins more secure. You can find a detailed explanation of SAML below.


### Let’s take an in-depth look at SAML {#in-depth look at SAML}

SAML stands for Security Assertion Markup Language. Its main purpose in online security is to enable you to access multiple web applications using one set of credentials. It works by passing authenticated credentials between two parties: an Identity Provider (IDP) and a Service Provider (SP). Doing so makes the user experience simpler while also providing better security.

 ![saml-diagram-2](/blog/assets/2023/saml-diagram-2.webp)

 ### Where can we use SAML SSO? {#where can we use SAML SSO}

The primary attribute of SAML is that it is used for authentication, not authorization. This means that a variety of applications, websites, and services that could be used to access and edit data from the service provider need to form a trusted relationship with the SSO website.


Now, when a user tries to access data from the service provider’s app, they’ll need to be authenticated at least once by entering a username and password before they can read or write onto this data. If, however, they have already done this once, then they will be granted access more directly. A SAML request will be generated by the application, asking to authenticate the user, to which the identity provider will respond with a SAML response.


This is particularly useful in situations where the service provider is offering their services across a wide range of applications. It inadvertently also increases the scope of the product by allowing a variety of third-party applications to offer their unique services using the same data.

For example:
- Data-driven statistics websites and applications for online multiplayer games.
- Social media applications and bulletin boards designed around the same topic.
- Online video streaming services with features for viewer engagement.
- Online software marketplaces like Steam that offer user analytics and metadata.

### What are the benefits of using ASP.NET MVC Single Sign On? {#benefits of using ASP.NET MVC Single Sign On}

**Shorter development time**: Using ASP.NET MVC Single Sign-On reduces development time by providing developers with a common authentication framework. It takes even more load off of them if the mechanism is independent.

**Reduction in costs**: Besides the fact that development time is reduced, support requests for forgotten passwords and IT help desk calls also go down, thereby lowering the overall costs.

**Increased security**: An important benefit of SSO is that it reduces the chance of users falling prey to phishing attacks. This is because the user is not trained to mindlessly enter their username and password everywhere. Furthermore, SSO systems usually force users to use secure communication channels. This means that only one place of authentication receives their credentials. The applications, however, don’t receive any specific information besides whether they should let the user in or not. This happens only once, resulting in a minimum transfer of sensitive information, which is naturally favorable.

**Streamlined administration**: The burden on the administrative system to manage user accounts is massively reduced with the implementation of SSO. Keep note, however, that SSO only takes care of authentication. The authorization of users based on their access privileges still needs to be set up separately.

**Improved user experience**: With ASP.NET MVC Single Sign On enabled, users don’t have to enter their usernames and passwords multiple times to access the same service across multiple applications and browsers.

### Additional Sources: {#Additional sources}
- [What is Single Sign-On (SSO)?](https://www.miniorange.com/products/single-sign-on-sso)
- [What is ASP.NET SAML Single Sign-On (SSO)?](https://plugins.miniorange.com/asp-net-saml-single-sign-on-sso)
- [Steps to Configure the ASP.NET SAML 2.0 Module](https://plugins.miniorange.com/asp-dot-net-saml-2-0-single-sign-sso-connector#steps)



How to use Single Sign-On for your ASP.NET MVC application?


## Seamless SSO and Identity Management {#seamless-sso-and-identity-management}

In the ever-evolving landscape of digital identity, achieving simplicity and efficiency is paramount. With the latest upgrade to the miniOrange SAML plugins, we're excited to announce the seamless integration of SCIM (System for Cross-domain Identity Management). This transformative addition, bundled for free with the miniOrange SAML plugins, brings a new dimension to your identity management strategy. 

&nbsp;

**This upgrade is available for all the following plugins:-**
1. [JIRA SAML Plugin](https://marketplace.atlassian.com/apps/1215430/mo-jira-saml-sso-single-sign-on-jira-sso-login?hosting=datacenter&tab=overview)
2. [Confluence SAML Plugin](https://marketplace.atlassian.com/apps/1215542/mo-confluence-saml-sso-single-sign-on-confluence-sso-login?hosting=datacenter&tab=overview)
3. [Bitbucket SAML Plugin](https://marketplace.atlassian.com/apps/1216482/mo-bitbucket-saml-sso-single-sign-on-bitbucket-sso-login?hosting=datacenter&tab=overview)

### Unlocking Synergy: SAML and SCIM in Harmony {#unlocking-synergy-saml-and-scim-in-harmony}

**Effortless Onboarding and Offboarding** 🧑‍🤝‍🧑
Imagine a new team member, Sarah, joining your organization. SAML seamlessly grants her access across applications with Single Sign-On (SSO). Before that, SCIM works behind the scenes, instantly creating her accounts and access rights. When another employee John leaves the company, SCIM steps in again, ensuring immediate removal of his access across all applications without manual intervention.

&nbsp;

**Streamlined User Attribute Management** 🚴
Maintaining consistency in user attributes is crucial. For instance, when Sarah gets promoted and joins a new team, SCIM ensures her updated role and group memberships are uniformly reflected across all applications. This meticulous approach eliminates discrepancies in user profiles and enhances accuracy.

&nbsp;

**Enhanced Security through Real-time Access Management** ⏳
Picture this: David, a team member, is terminated. SAML provides secure and straight forward authentication, and when combined with SCIM, it allows you to instantly revoke David's access. This immediate response fortifies your security posture and minimizes potential risks by promptly removing access for deactivated or terminated users.

&nbsp;

**Scalable Identity Management for Growing Organizations** 🦸
As your organization expands, managing user identities can become complex. SAML ensures a unified and secure authentication process. Now, consider Sarah's team growing. SCIM simplifies the complexity of user provisioning, allowing you to easily scale your identity management processes without compromising efficiency. In this dynamic scenario, imagine new team members joining rapidly. SCIM, the superhero of identity management, automates user provisioning, ensuring seamless access for new members to the tools they need. This dual approach of SAML and SCIM not only guarantees a secure authentication process but also streamlines identity management, making it agile and scalable as your organization evolves.

&nbsp;

### How to Experience the Synergy: {#how-to-experience-the-synergy}

1. Update Your miniOrange SAML Plugin to the latest version.
2. Go to the “SCIM” tab in the settings section. You need to download the SCIM plugin separately but it will be available at no extra cost once you purchase our SAML plugin.
3. Here, you can seamlessly configure and customize your SCIM settings to align with your organization's requirements.
4. Once configured, witness the harmonious collaboration between SAML and SCIM. Enjoy the benefits of secure SSO and automated user provisioning, making identity management a smooth and efficient process.

&nbsp;

**Elevate Your Identity Management Strategy** 👆
With SAML and SCIM working in tandem, miniOrange offers a robust solution for organizations seeking a streamlined, secure, and scalable identity management strategy. Upgrade your miniOrange SAML plugin today to unlock the combined power of SAML and SCIM, where simplicity meets security in the realm of digital identity.



In the ever-evolving landscape of digital identity, achieving simplicity and efficiency is paramount. With the latest upgrade to the miniOrange SAML plugins, we're excited to announce the seamless integration of SCIM.

Seamless SSO and Identity Management: Unleashing the Power of SAML and SCIM Integration in miniOrange Plugin 🚀


### What is SAML? {#what-is-saml}

SAML - Security Assertion Markup Language, it is an XML standard that allows secure web domains to exchange user authentication and authorization data. Using SAML 2.0, an online service provider (SP) can contact a separate online identity provider to authenticate users who are trying to access secure content.

SAML 2.0 authentication protocol is popular for browser-based enterprise applications. SAML 2.0 uses XML data format to transfer messages between applications. This XML document is digitally signed by the Identity provider and shared with the Service provider (SP) during the user authentication process.


### Basics Of SAML {#basics-of-saml}
1.&nbsp;[**SAML Service Provider (SP):**](https://plugins.miniorange.com/wordpress-single-sign-on-sso) A SAML Service Provider (SP) is a system entity that receives and accepts authentication assertions in conjunction with a Single Sign-On (SSO) profile of the Security Assertion Markup Language (SAML).

2.&nbsp;[**SAML Identity Provider (IDP):**](https://plugins.miniorange.com/wordpress-saml-idp) A SAML Identity Provider (IDP) is a system entity that issues authentication assertions in conjunction with a single sign-on (SSO) profile of the Security Assertion Markup Language (SAML). An Identity Provider performs the authentication that the end user is who they say they are and sends that data to the service provider along with the user’s access rights for the service.

3.&nbsp;**SAML Request:** A SAML Request, also referred to as an authentication request, it is generated by the Service Provider (SP) to "request" an authentication.

4.&nbsp;**SAML Response:** A SAML Response is generated by the Identity Provider (IDP). It contains the actual assertion of the authenticated user. In addition, a SAML Response may contain additional information about the user, such as user profile information, group/role information, etc.

### SAML Single Sign-On (SSO) {#saml-single-sign-on}
SAML Single Sign-On (SSO) is an authentication process in which a user is provided access to multiple applications and/or websites by using only a single set of login credentials (such as username and password). This prevents the need for the user to login separately into the different applications.

The user credentials and other identity information is stored and managed by a centralized system called Identity Provider (IDP). The Identity Provider (IDP) is a trusted system which provides access to other websites and applications.  


### How SAML 2.0 Works {#how-saml-works}
SAML SSO works by transferring the user’s identity from the Identity Provider (IDP) to the Service Provider(SP). This is done through an exchange of digitally signed XML documents. Consider the following Use Case: A user is logged into a system that acts as an Identity Provider(IDP). The user wants to log in to a remote application, i.e. the Service Provider(SP). The following is the flow taking place:
 
1.&nbsp;The user **requests a resource** from their desired application/website (Service Provider).  
2.&nbsp;The Identity Provider (IDP) verifies the user.  
3.&nbsp;The [Service Provider](https://docs.miniorange.com/documentation/saml/service-provider-info) identifies the IDP (Identity Provider) and redirects the user back to IDP with authentication request.  
4.&nbsp;The **Identity Provider** sends a response with the XHTML form.  
5.&nbsp;Identity Provider (IDP) sends the XML document (SAML Assertion) to the Service Provider (SP) which contains the user authorization.

### SAML 2.0 Single Sign-On (SSO) Flow:
![SAML Protocol flow](/blog/assets/2025/saml-sso.webp)
 
### Benefits of SAML 2.0 Authentication {#benefits}

1. **SAML 2.0 Single Sign-On (SSO):** SAML provides fastest & efficient access to multiple applications through assertion which helps to connect SAML support Service Provider (SP) to Identity Provider (IDP). SAML 2.0 provides a better user experience through assertion which communicates between the Service Provider (SP) & the Identity Server (IDP).  
2. **Increased Security:** SAML authentication eliminates the passwords & provides authentication through digital signature. SAML 2.0 also uses the Public Key Infrastructure (PKI) to protect identities from attacks. SAML SSO provides a single point of authentication, which happens at a secure identity provider (IDP). Then, SAML transfers the identity information to the service providers (SP). This form of authentication ensures that credentials are only sent to the IDP (Identity Provider) directly.  
3. **Reduce Password recovery time:** SAML SSO will eliminate password issues such as reset and recovery, which will reduce the time to recover old passwords.  
4. **Reduced costs for the Service Provider (SP):** With SAML SSO you don't have to maintain an account for multiple services. The identity provider (IDP) will burden this.  
5. **Improved User experience:** Without any authentication, a user can access multiple service providers by signing in just once which allows a faster and better experience at each Service Provider (SP).  
6. **Standardization:** SAML 2.0 interoperates with any system independent of implementation because of its standardized format.  
7. **Loose Coupling of Directories:** SAML does not require maintaining and synchronizing user information between directories.  
 

### SAML Assertion {#saml-assertion}
SAML 2.0 Assertion is a XML document provided by Identity Provider (IdP) to the service provider (SP) which contains the user authorization. SAML 2.0 assertions contain all the information necessary for a Service Provider (SP) to confirm user identity, including the source of the assertion, the time it was issued, and the conditions that make the assertion valid. There are three types of SAML Assertions.  

1. **Authentication Assertion:** The specified subject was authenticated by a particular means at a particular time. This kind of statement is typically generated by a SAML authority called an Identity Provider, which is in charge of authenticating users and keeping track of other information about them.  
2. **Attribute Assertion:** The specified subject is associated with the supplied attributes.  
3. **Attribute Decision Assertion:** A request to allow the specified subject to access the specified resource has been granted or denied.  

An assertion consists of one or more statements. For single sign-on, a typical SAML assertion will contain a single authentication statement and possibly a single attribute statement. Note that a SAML response could contain multiple assertions, although it's more typical to have a single assertion within a response.

The SAML specification defines three roles:
 - The principal (typically a user)
 - The Identity Provider (IDP)
 - The Service Provider (SP)

In the use case addressed by SAML, the principal requests a service from the Service Provider (SP). The Service Provider requests and obtains an identity assertion from the Identity Provider (IDP). Based on this assertion, the Service Provider (SP) can make an access control decision - in other words it can decide whether to perform some service for the connected principal.


### SAML 2.0 Example {#saml-example}
How to configure miniOrange Self-Service Console as a service provider by accepting a SAML assertion generated by the miniOrange IDP.  

1. Register a Service Provider on the Identity Server:  
- Add Issuer as miniOrange.  
- Assertion Consumer URL as https://login.xecurify.com/moas/samlresponse  
- Make sure Enable Attribute Profile is checked.  
- Add email address in Attribute Claims.  
- Make sure Include Attributes in the Response Always is checked.  

2. User selects SAML SSO from End User Sign In window to login using miniOrange Identity Server.  
3. miniOrange Authentication Service sends an authentication SAML request along with Attribute Query to miniOrange Identity Server along with the Consumer Index generated after registering miniOrange as a Service Provider on the Identity Server.  
4. miniOrange IDP parses the SAML request and redirects to Identity Server Login page.  
5. User enters the username & password. If valid credentials are entered, IdP sends an encoded SAML Response to the miniOrange Authentication Service with the email address of the user.  
6. miniOrange Authentication Service receives SAML response, decodes it, parses the email ID of the user. If a valid email address is found, it logs in the user into self-service console.  

Also, you can configure miniOrange Self-Service Console as a service provider (SP) with Other Identity Providers (IDPs) like Okta, OneLogin, Azure AD, Auth0 etc.

### SAML vs. OAuth {#saml-vs-oauth}
OAuth is a slightly newer standard that was co-developed by Google and Twitter to enable streamlined internet logins. OAuth uses a similar methodology as SAML to share login information. SAML 2.0 provides more control to enterprises to keep their SSO logins more secure, whereas OAuth is better on mobile and uses JSON. Facebook and Google are two OAuth providers that you might use to log into other internet sites.
| Feature                                                        | SAML 2.0                                                        | OAuth                                       |
|-------------------------------------------------------------|--------------------------------------------|--------------------------------------------|
| **Protocol** | SAML is an authentication protocol. | OAuth is an authorization protocol.|
| **Usage Scenario** | SAML 2.0 will be used by those who are looking for federation and identity management. They will use this identity to login the users to different applications.| OAuth will be used by those who are not looking to maintain identities but are rather trying to leverage the implementation of secure protocol by applications such as Google, Microsoft, Paypal, who ensure that the identities are authentic.|
| **Suitable Application** | SAML 2.0 is popular for browser-based applications.| OAuth is suitable for both browser and mobile applications.|
| **Commonly Used By** | SAM 2.0 is widely used for enterprise applications.| OAuth is widely used for customer applications and API access.|
| **Data Format**| SAML 2.0 uses XML to transfer messages between applications.| OAuth uses JSON to transfer messages between applications.|


### Additional Resources {#additional-resources}  
1. [Single Sign-On](https://www.miniorange.com/products/single-sign-on-sso)  
2. [miniOrange Identity Provider](https://idp.miniorange.com)  
3. [WordPress SAML Single-On](https://plugins.miniorange.com/wordpress-single-sign-on-sso)  

Know how security assertion markup language, SAML works to exchange authentication and authorization data in web domain security in XML format.

How to use Single Sign-On for your ASP.NET MVC application?

Seamless SSO and Identity Management: Unleashing the Power of SAML and SCIM Integration in miniOrange Plugin 🚀

What is Security Assertion Markup Language (SAML)?