🍜Protocol Soup

IdP-Initiated SSO

Identity Provider initiated Single Sign-On where the IdP sends an unsolicited SAML Response to the SP without a preceding AuthnRequest (saml-profiles §4.1.5). The user starts at the IdP portal and selects an application to access. This flow has inherently weaker security properties than SP-initiated SSO because the SP cannot correlate the response to an original request, making replay and CSRF attacks harder to detect.

Try in Looking Glass
XML-BasedSSO

Sequence Diagram

Click any step for details

UserIdPSP1User Selects Application at IdP2IdP Creates Unsolicited Response3POST Response to SP4SP Validates Unsolicited Response5Session Created and Access Granted
Request
Response
Redirect
Internal

Step-by-Step Breakdown

1
User Selects Application at IdP
User → Identity Provider
2
IdP Creates Unsolicited Response
Identity Provider → Identity Provider
3
POST Response to SP
Identity Provider → Service Provider
4
SP Validates Unsolicited Response
Service Provider → Service Provider
5
Session Created and Access Granted
Service Provider → User

Token Inspector

Specs for this flow

Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.
BackLooking Glass