In this scenario, the service provider (SP) sends an HTTP redirect message to the identity provider (IdP) containing an authentication request. The IdP returns a SAML response with an assertion to the SP through HTTP POST.
- A user requests access to a protected SP resource. The user is not logged on to the site. The request redirects to the federation server to handle authentication.
- The SP returns an HTTP redirect code, 302 or 303, containing a SAML request for authentication through the user's browser to the IdP's single sign-on (SSO) service.
- If the user is not already logged on to the IdP site or needs to re-authenticate, The IdP asks for credentials, such as ID and password, and the user logs on.
- The user data store can provide additional information about the user for inclusion in the SAML response. The federation agreement between the IdP and the SP predetermines these attributes. See User attributes.
- The IdP's SSO service returns an HTML form to the browser with a SAML
response containing the authentication assertion and any additional attributes. The browser
automatically posts the HTML form back to the SP.Note:
SAML specifications require digitally-signed POST responses.
- (Not shown) If the signature and the assertion, or the JSON Web Token, are valid, the SP establishes a session for the user and redirects the browser to the target resource.