samly
An Elixir Plug library for adding SAML 2.0 Service Provider Single-Sign-On authentication to Phoenix/Plug applications.
What is samly?
Samly is an Elixir library that enables SAML 2.0 Service Provider (SP) Single-Sign-On (SSO) authentication for applications built with the Phoenix framework or Plug. It allows developers to integrate enterprise-grade identity management by connecting to a wide range of Identity Providers (IdPs) like Okta, Ping Identity, and ADFS.
Elixir developers building Phoenix or Plug-based applications that require SAML 2.0 SSO integration with enterprise identity providers. It is particularly suited for teams needing to authenticate users via existing corporate or institutional IdPs.
Developers choose Samly for its security-first design, flexibility in supporting multiple IdPs and URL routing models, and seamless integration into the Elixir/Plug ecosystem. It provides a robust, standards-compliant implementation with extensible pipelines and state stores for complex authentication scenarios.
Overview
Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications.
Use Cases
Best For
- Adding SAML 2.0 SSO authentication to a Phoenix web application for enterprise users.
- Integrating with multiple Identity Providers like Okta, Ping Identity, or ADFS from a single Elixir service.
- Implementing IdP-initiated SSO flows with configurable target URL whitelisting.
- Customizing SAML attribute transformation and Just-in-Time user provisioning via Plug pipelines.
- Deploying in clustered environments using session-based state stores instead of ETS.
- Developing applications that require signed and encrypted SAML assertions for enhanced security.
Not Ideal For
- Projects using OAuth 2.0 or OpenID Connect for authentication, as Samly is exclusively for SAML 2.0.
- Non-Elixir applications, such as those built with Ruby or Node.js, since Samly is designed for the Elixir/Plug ecosystem.
- Teams seeking a plug-and-play SSO solution with minimal configuration, due to Samly's manual certificate and metadata setup requirements.
- Applications that require built-in UI for login flows, as Samly handles backend SAML integration without frontend components.
Pros & Cons
Pros
Supports a wide range of Identity Providers like Okta, Ping Identity, and ADFS, as listed in the README, ensuring seamless enterprise integration without vendor lock-in.
Offers both URL path segment and subdomain-based routing for IdP identification, providing deployment flexibility for different hosting scenarios and multi-tenant setups.
Allows custom Plug pipelines for attribute transformation and Just-in-Time user provisioning, enabling deep customization of authentication flows as demonstrated in the README's sample pipeline.
Enforces signed requests/responses by default, supports encrypted assertions, and includes checks for replay attacks, prioritizing security standards and compliance.
Cons
Requires manual generation of certificates, handling of IdP metadata files, and detailed configuration, which can be time-consuming and error-prone for developers new to SAML.
The README admits that replay attack checks are not built-in; developers must implement them using custom pipelines or external stores, adding complexity and potential security gaps.
Core documentation often references external repos like samly_howto for setup, which may fragment the learning experience and require additional effort to piece together.
Frequently Asked Questions
Related Projects
guardianElixir Authentication
ueberauthAn Elixir Authentication System for Plug-based Web Applications
powRobust, modular, and extendable user authentication system
coherenceCoherence is a full featured, configurable authentication system for Phoenix
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.