In this scenario, the SP sends an HTTP redirect message to the IdP containing an
authentication request. The IdP returns a SAML response with an assertion to the SP
via HTTP POST.Processing steps
A user requests access to a protected SP resource. The user is not logged on to
the site. The request is redirected to the federation server to handle
The SP returns an HTTP redirect (code 302 or 303) containing a SAML request for
authentication through the user's browser to the IdP's SSO service.
If the user is not already logged on to the IdP site or if re-authentication is
required, the IdP asks for credentials (e.g., ID and password) and the user logs
Additional information about the user may be retrieved from the user data store
for inclusion in the SAML response. (These attributes are predetermined as part
of the federation agreement between the IdP and the SP—see About attributes.)
The IdP's SSO service returns an HTML form to the browser with a SAML response
containing the authentication assertion and any additional attributes. The
browser automatically posts the HTML form back to the SP.
NoteSAML specifications require that POST responses be digitally
(Not shown) If the signature and the assertion (or the JSON Web Token) are
valid, the SP establishes a session for the user and redirects the browser to
the target resource.