SSO SiteMinder / Keycloak cllients Gateway

,
1

Hello everyone
For one of my clients, I am looking for a flexible solution…
My client uses an old version of SiteMinder. It has a lot of apps hooked up to SiteMinder.
My client will have difficulty carrying out new developments of these applications to interface with SAML or AuthO2 type SSO. Adding middleware by interfacing with AuthO2 seems complex in terms of time, because the developers are very busy.

I’m looking for a solution that could concentrate SSO requests for these applications while they adapt to SAML, API or other protocols. All of that without doing intrusive change on application environnement.

I imagined a gateway that would accommodate SiteMinder authentication requests and translate them into modern protocols like AuthO2 or API calls. For example, SSO requests would go to Front-End on an NGINX and would be “translated” into AuthO2 or by making API calls.
Obviously this gateway will necessarily have a large processing load.

Do you have any idea if this is feasible or if there is another solution?

Thanks for your help !

2

If you don’t want to or can’t change the application, I would recommend using a proxy such as Nginx with a module like lua-resty-openidc [1] (there are also several other proxies with OIDC modules/extensions).
You can use OpenID Connect for handling authentication and OAuth 2.0 for authorization cases.

[1] GitHub - zmartzone/lua-resty-openidc: OpenID Connect Relying Party and OAuth 2.0 Resource Server implementation in Lua for NGINX / OpenResty