Basic clarification regarding SAML

0
votes

I need to implement a SAML based authentication module and I am looking for answers to some basic question related to SAML. I tried searching for answers but couldn't find detailed information.

Resources to be protected is a SaaS based web application. Design I have received require4s building an authentication module using OpenAM, Ping, etc. Any access to web application will get authenticated through authentication system via SAML.

Questions that I have in this regard are:

  1. If I understand correctly, SAML request contains a username. When someone first access web application, application has no information about user, how will it generate an SAML request then?

  2. Once a SAML response is received by application, do subsequent access of web application by user also need to be routed and validated via authentication system?

  3. Web application can interact with other sub-systems via web services or api calls. How can authentication context be passed to those systems.

1
saml
Unlike forum sites, we don't use "Thanks", or "Any help appreciated", or signatures on Stack Overflow. See "Should 'Hi', 'thanks,' taglines, and salutations be removed from posts?. - John Saunders

1 Answers

1
votes
  1. No, the AuthnRequest does not have to contain a user name. It may, but in most cases it doesn't.
  2. No, once the SAML response is received, the application typically set a cookie to create a local session.
  3. The SAML Assertion can be passed to other services that the application uses. This is a non-trivial setup, but possible.