In SAML 2.0, as in SAML 1.1, the primary
use case is still Web Browser SSO, but the scope of SAML 2.0 is broader than previous versions of SAML, as suggested in the following exhaustive list of profiles: • SSO Profiles •
Web browser SSO profile • Enhanced Client or Proxy (ECP) Profile •
Identity Provider Discovery Profile • Single Logout Profile • Name Identifier Management Profile • Artifact Resolution Profile •
Assertion Query/Request Profile • Name Identifier Mapping Profile • SAML Attribute Profiles • Basic Attribute Profile • X.500/LDAP Attribute Profile • UUID Attribute Profile • DCE PAC Attribute Profile • XACML Attribute Profile Although the number of supported profiles is quite large, the Profiles specification (SAMLProf) is simplified since the binding aspects of each profile have been factored out into a separate Bindings specification (SAMLBind).
Web browser SSO profile SAML 2.0 specifies a
Web Browser SSO Profile involving an identity provider (IdP), a service provider (SP), and a principal wielding an HTTP user agent. The service provider has four bindings from which to choose while the identity provider has three, which leads to twelve possible deployment scenarios. We outline three of those deployment scenarios below.
SP redirect request; IdP POST response This is one of the most common scenarios. The service provider sends a SAML Request to the IdP SSO Service using the HTTP-Redirect Binding. The identity provider returns the SAML Response to the SP Assertion Consumer Service using the HTTP-POST Binding. The message flow begins with a request for a secured resource at the service provider.
1. Request the target resource at the SP The principal (via an HTTP user agent) requests a target resource at the service provider: https://sp.example.com/myresource The service provider performs a security check on behalf of the target resource. If a valid security context at the service provider already exists, skip steps 2–7. The service provider may use any kind of mechanism to discover the identity provider that will be used, e.g., ask the user, use a preconfigured IdP, etc.
2. Redirect to IdP SSO Service The service provider generates an appropriate SAMLRequest (and RelayState, if any), then redirects the browser to the IdP SSO Service using a standard
HTTP 302 redirect. 302 Redirect Location: https://idp.example.org/SAML2/SSO/Redirect?SAMLRequest=request&RelayState=token The RelayState token is an opaque reference to state information maintained at the service provider. The value of the SAMLRequest parameter is a deflated, base64-encoded and URL-encoded value of an element: https://sp.example.com/SAML2 The SAMLRequest may be signed using the SP signing key. Typically, however, this is not necessary.
3. Request the SSO Service at the IdP The user agent issues a GET request to the SSO service at the identity provider: GET /SAML2/SSO/Redirect?SAMLRequest=request&RelayState=token HTTP/1.1 Host: idp.example.org where the values of the SAMLRequest and RelayState parameters are the same as those provided in the redirect. The SSO Service at the identity provider processes the element (by URL-decoding, base64-decoding and inflating the request, in that order) and performs a security check. If the user does not have a valid security context, the identity provider identifies the user with any mechanism (details omitted).
4. Respond with an XHTML form The SSO Service validates the request and responds with a document containing an XHTML form: ... The value of the RelayState parameter has been preserved from step 3. The value of the SAMLResponse parameter is the base64 encoding of the following element: https://idp.example.org/SAML2 https://idp.example.org/SAML2 ... 3f7b3dcf-1674-4ecd-92c8-1544f346baf8 https://sp.example.com/SAML2 urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
5. Request the Assertion Consumer Service at the SP The user agent issues a POST request to the Assertion Consumer Service at the service provider: POST /SAML2/SSO/POST HTTP/1.1 Host: sp.example.com Content-Type: application/x-www-form-urlencoded Content-Length: nnn SAMLResponse=response&RelayState=token where the values of the SAMLResponse and RelayState parameters are taken from the XHTML form at step 4.
6. Redirect to the target resource The assertion consumer service processes the response, creates a security context at the service provider and redirects the user agent to the target resource.
7. Request the target resource at the SP again The user agent requests the target resource at the service provider (again): https://sp.example.com/myresource
8. Respond with requested resource Since a security context exists, the service provider returns the resource to the user agent.
SP POST Request; IdP POST Response This is a relatively simple deployment of the SAML 2.0 Web Browser SSO Profile (SAMLProf) where both the service provider (SP) and the identity provider (IdP) use the HTTP POST binding. The message flow begins with a request for a secured resource at the SP.
1. Request the target resource at the SP The principal (via an HTTP user agent) requests a target resource at the service provider: https://sp.example.com/myresource The service provider performs a security check on behalf of the target resource. If a valid security context at the service provider already exists, skip steps 2–7.
2. Respond with an XHTML form The service provider responds with a document containing an XHTML form: ... The RelayState token is an opaque reference to state information maintained at the service provider. The value of the SAMLRequest parameter is the base64 encoding of the following element: https://sp.example.com/SAML2 Before the element is inserted into the XHTML form, it is first base64-encoded.
3. Request the SSO Service at the IdP The user agent issues a POST request to the SSO service at the identity provider: POST /SAML2/SSO/POST HTTP/1.1 Host: idp.example.org Content-Type: application/x-www-form-urlencoded Content-Length: nnn SAMLRequest=request&RelayState=token where the values of the SAMLRequest and RelayState parameters are taken from the XHTML form at step 2. The SSO service processes the element (by URL-decoding, base64-decoding and inflating the request, in that order) and performs a security check. If the user does not have a valid security context, the identity provider identifies the user (details omitted).
4. Respond with an XHTML form The SSO service validates the request and responds with a document containing an XHTML form: ... The value of the RelayState parameter has been preserved from step 3. The value of the SAMLResponse parameter is the base64 encoding of the following element: https://idp.example.org/SAML2 https://idp.example.org/SAML2 ... 3f7b3dcf-1674-4ecd-92c8-1544f346baf8 https://sp.example.com/SAML2 urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
5. Request the Assertion Consumer Service at the SP The user agent issues a POST request to the assertion consumer service at the service provider: POST /SAML2/SSO/POST HTTP/1.1 Host: sp.example.com Content-Type: application/x-www-form-urlencoded Content-Length: nnn SAMLResponse=response&RelayState=token where the values of the SAMLResponse and RelayState parameters are taken from the XHTML form at step 4.
6. Redirect to the target resource The assertion consumer service processes the response, creates a security context at the service provider and redirects the user agent to the target resource.
7. Request the target resource at the SP again The user agent requests the target resource at the service provider (again): https://sp.example.com/myresource
8. Respond with requested resource Since a security context exists, the service provider returns the resource to the user agent.
SP redirect artifact; IdP redirect artifact This is a complex deployment of the SAML 2.0 Web Browser SSO Profile (SAMLProf) where both the service provider (SP) and the identity provider (IdP) use the HTTP Artifact binding. Both artifacts are delivered to their respective endpoints via HTTP GET. The message flow begins with a request for a secured resource at the SP:
1. Request the target resource at the SP The principal (via an HTTP user agent) requests a target resource at the service provider: https://sp.example.com/myresource The service provider performs a security check on behalf of the target resource. If a valid security context at the service provider already exists, skip steps 2–11.
2. Redirect to the Single Sign-on (SSO) Service at the IdP The service provider redirects the user agent to the single sign-on (SSO) service at the identity provider. A RelayState parameter and a SAMLart parameter are appended to the redirect URL.
3. Request the SSO Service at the IdP The user agent requests the SSO service at the identity provider: https://idp.example.org/SAML2/SSO/Artifact?SAMLart=
artifact_1&RelayState=
token where
token is an opaque reference to state information maintained at the service provider and
artifact_1 is a SAML artifact, both issued at step 2.
4. Request the Artifact Resolution Service at the SP The SSO service dereferences the artifact by sending a element bound to a SAML SOAP message to the artifact resolution service at the service provider: https://idp.example.org/SAML2 ...
artifact_1 where the value of the element is the SAML artifact transmitted at step 3.
5. Respond with a SAML AuthnRequest The artifact resolution service at the service provider returns a element (containing an element) bound to a SAML SOAP message to the SSO service at the identity provider: ... https://sp.example.com/SAML2 The SSO service processes the element and performs a security check. If the user does not have a valid security context, the identity provider identifies the user (details omitted).
6. Redirect to the Assertion Consumer Service The SSO service at the identity provider redirects the user agent to the assertion consumer service at the service provider. The previous RelayState parameter and a new SAMLart parameter are appended to the redirect URL.
7. Request the Assertion Consumer Service at the SP The user agent requests the assertion consumer service at the service provider: https://sp.example.com/SAML2/SSO/Artifact?SAMLart=
artifact_2&RelayState=
token where
token is the token value from step 3 and
artifact_2 is the SAML artifact issued at step 6.
8. Request the Artifact Resolution Service at the IdP The assertion consumer service dereferences the artifact by sending a element bound to a SAML SOAP message to the artifact resolution service at the identity provider: https://sp.example.com/SAML2 ...
artifact_2 where the value of the element is the SAML artifact transmitted at step 7.
9. Respond with a SAML Assertion The artifact resolution service at the identity provider returns a element (containing an element) bound to a SAML SOAP message to the assertion consumer service at the service provider: ... https://idp.example.org/SAML2 ... https://idp.example.org/SAML2 user@mail.example.org https://sp.example.com/SAML2 urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
10. Redirect to the target resource The assertion consumer service processes the response, creates a security context at the service provider and redirects the user agent to the target resource.
11. Request the target resource at the SP again The user agent requests the target resource at the service provider (again): https://sp.example.com/myresource
12. Respond with the requested resource Since a security context exists, the service provider returns the resource to the user agent.
Identity provider discovery profile The SAML 2.0
Identity Provider Discovery Profile introduces the following concepts: •
Common Domain •
Common Domain Cookie •
Common Domain Cookie Writing Service •
Common Domain Cookie Reading Service As a hypothetical example of a
Common Domain, let's suppose Example UK (example.co.uk) and Example Deutschland (example.de) belong to the virtual organization Example Global Alliance (example.com). In this example, the domain
example.com is the common domain. Both Example UK and Example Deutschland have a presence in this domain (uk.example.com and de.example.com, resp.). The
Common Domain Cookie is a secure browser cookie scoped to the common domain. For each browser user, this cookie stores a history list of recently visited IdPs. The name and value of the cookie are specified in the IdP Discovery Profile (SAMLProf). After a successful act of authentication, the IdP requests the
Common Domain Cookie Writing Service. This service appends the IdP's unique identifier to the common domain cookie. The SP, when it receives an unauthenticated request for a protected resource, requests the
Common Domain Cookie Reading Service to discover the browser user's most recently used IdP.
Assertion query/request profile The
Assertion Query/Request Profile is a general profile that accommodates numerous types of so-called
queries using the following SAML 2.0 elements: • the element, which is used to request an assertion given its unique identifier (ID) • the element, which is an abstract extension point that allows new subject-based SAML queries to be defined • the element, which is used to request
existing authentication assertions about a given subject from an Authentication Authority • the element, which is used to request attributes about a given subject from an Attribute Authority • the element, which is used to request an authorization decision from a
trusted third party The SAML SOAP binding is often used in conjunction with queries.
SAML attribute query The
Attribute Query is perhaps the most important type of SAML query. Often a requester, acting on behalf of the principal, queries an identity provider for attributes. Below we give an example of a query issued by a principal directly: CN=trscavo@example.com,OU=User,O=NCSA-TEST,C=US CN=trscavo@example.com,OU=User,O=NCSA-TEST,C=US Note that the Issuer is the Subject in this case. This is sometimes called an
attribute self-query. An identity provider might return the following assertion, wrapped in a element (not shown): https://idp.example.org/SAML2 ... CN=trscavo@example.com,OU=User,O=NCSA-TEST,C=US MIICiDCCAXACCQDE+9eiWrm62jANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJV UzESMBAGA1UEChMJTkNTQS1URVNUMQ0wCwYDVQQLEwRVc2VyMRMwEQYDVQQDEwpT UC1TZXJ2aWNlMB4XDTA2MDcxNzIwMjE0MVoXDTA2MDcxODIwMjE0MVowSzELMAkG A1UEBhMCVVMxEjAQBgNVBAoTCU5DU0EtVEVTVDENMAsGA1UECxMEVXNlcjEZMBcG A1UEAwwQdHJzY2F2b0B1aXVjLmVkdTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC gYEAv9QMe4lRl3XbWPcflbCjGK9gty6zBJmp+tsaJINM0VaBaZ3t+tSXknelYife nCc2O3yaX76aq53QMXy+5wKQYe8Rzdw28Nv3a73wfjXJXoUhGkvERcscs9EfIWcC g2bHOg8uSh+Fbv3lHih4lBJ5MCS2buJfsR7dlr/xsadU2RcCAwEAATANBgkqhkiG 9w0BAQQFAAOCAQEAdyIcMTob7TVkelfJ7+I1j0LO24UlKvbLzd2OPvcFTCv6fVHx Ejk0QxaZXJhreZ6+rIdiMXrEzlRdJEsNMxtDW8++sVp6avoB5EX1y3ez+CEAIL4g cjvKZUR4dMryWshWIBHKFFul+r7urUgvWI12KbMeE9KP+kiiiiTskLcKgFzngw1J selmHhTcTCrcDocn5yO2+d3dog52vSOtVFDBsBuvDixO2hv679JR6Hlqjtk4GExp E9iVI0wdPE038uQIJJTXlhsMMLvUGVh/c0ReJBn92Vj4dI/yy6PtY/8ncYLYNkjg oVN0J/ymOktn9lTlFyTiuY4OuJsZRO1+zWLy9g== urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient Tom trscavo@example.org In contrast to the
BearerAssertion shown earlier, this assertion has a longer lifetime corresponding to the lifetime of the
X.509 certificate that the principal used to authenticate to the identity provider. Moreover, since the assertion is signed, the user can push this assertion to a relying party, and as long as the user can prove possession of the corresponding private key (hence the name "holder-of-key"), the relying party can be assured that the assertion is authentic. ==SAML 2.0 metadata==