SAML2: Does a SP initiated web-SSO szenario requires an IdP in the same domain where the requested SP running

Question

My customer wants me to implement some stuff for a SP initiated web-SSO szenario, that deals with a SP that runs in our DMZ and redirects an unauthorized web access to an IdP, that is hosted by another operator/company inside (what a surprise) their DMZ.

I am bit confursed about this szenario, because i remember, that this would require a federation between two IdP's, strictly speaking: their IdP and ours, that actually does not exist.

Besides i figured out, that the idea behind the SAML-artifact protocol is to save ressources and to communicate more secure by accessing directly the SP by the IdP, instead of use HTML-redirects over the internet. But when IdP and SP are running in different domains, there will be still a access through the internet (dangerman zone).

Am i right, that the given net-architecture results of a misunderstanding of the SAML2 specification. Are there some security impacts (like man-in-the-middle).

Answer 1

It's perfectly fine to connect your SP directly to their IDP. Even though organizations often set up a proxy IDP as a centralized point for communicating with other IDPs, it's not required.

SAML2 is perfectly secure to run over public Internet. All messages are protected by cryptographical signatures, so there is no man in the middle attack.

In your scenario it might be more simple to use Redirect and POST bindings than Artifact as those won't require a direct line of communication between the SP and the IDP.