SAML
Notes on the XML-based protocol for setting up single-sign-on
- XML-based assertion framework for authenticating people across different services
Common SAML-Based SSO Configurations to be Aware of
- When setting up a SP-initiated auth flow, your IDP will generally prefer a specific “binding”; either of the following:
HTTP POSTHTTP Redirect
- In order for SP-Initiated Auth to work correctly, and to support deep links and bookmarks that will work with SSO, your IDP should support
RelayState- Allows you to pass parameters in the URL (or even the URL that you want to hit in the first place), and the IDP preserves these parameters and URL after the authentication is completed
- Example flow for IDP that supports it:
- You are navigated to https://solvd.my.salesforce.com/home/my-fancy-url?a=b
- Salesforce navigates you automatically to Auth0 as your IDP
- You authenticate correctly
- Auth0 redirects you back to https://solvd.my.salesforce.com/home/my-fancy-url?a=b, preserving the URL and parameters for where you wanted to go initially.
- You can have the Identity of the SAML assertion exist in the
NameIdentifierelement of the Subject statement, OR in a specific Attribute XML node that you’ve pre-determined