Determine if IDP initiated or SP initiated in SP callback?

Question

I am using passport-saml authentication module in my node application. In the registered IDP callback function that resides in my SP I need to determine if the callback was SP initiated or IDP initiated.

Does SAML have something in the request url, headers, etc that I can use in my SP to determine who initiated the flow?

Answer 1

If SP-initiated SSO flow was used, the SAML response has an attribute InResponseTo. This must be checked against the value of the ID attribute of the related SAML AuthnRequest.