IdP-Initiated SSO

Abstract

In this scenario, the user is logged on to the IdP and attempts to access a resource on the Infinite BrassRing Platform server. The SAML 2.0 assertion is transported to the Infinite BrassRing Platform via HTTP POST.

IdP-initiated SSO

As shown in the diagram, the IdP-initiated SSO process is as follows:

1. The user logs on to the IdP.

2. The user requests access to a protected Infinite BrassRing Platform resource. The user is not logged on to the Infinite BrassRing Platform site.

3. The IdP SSO service returns a HTTP form to the browser with a SAML response containing the authentication assertion and any additional attributes.

4. The browser automatically posts the HTML form back to the Infinite BrassRing Platform.

5. (Not shown) If a valid assertion is received, then a session is established on the Infinite BrassRing Platform and the browser is redirected to the target resource.