IdP-Initiated SSO

Abstract

In this scenario, the user is logged on to the IdP and attempts to access a resource on the BrassRing ATS  Platform server. The SAML 2.0 assertion is transported to the BrassRing ATS  Platform via HTTP POST.

IdP-initiated SSO

As shown in the diagram, the IdP-initiated SSO process is as follows:

1. The user logs on to the IdP.

2. The user requests access to a protected BrassRing ATS  Platform resource. The user is not logged on to the BrassRing ATS  Platform site.

3. The IdP SSO service returns a HTTP form to the browser with a SAML response containing the authentication assertion and any additional attributes.

4. The browser automatically posts the HTML form back to the BrassRing ATS  Platform.

5. (Not shown) If a valid assertion is received, then a session is established on the BrassRing ATS  Platform and the browser is redirected to the target resource.