3 ms·
What about for an idp-initiated flow? Last time I checked on this SAML was the more logical choice.
by seandoe 2y ago
What about for an idp-initiated flow? Last time I checked on this SAML was the more logical choice.
- mdavidn 2y agoThe "OIDC way" would be an endpoint on the service provider ("relying party" in the spec) that immediately redirects into authentication. The spec does have a section describing this. https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin https://openid.net/specs/openid-connect-core-1_0.html#ThirdP...
- jahewson 2y agoIDP-initiated flows are less secure, as they cannot prevent unsolicited logins. Last time I checked Google went as far as to block this flow in their Firebase Auth product. https://www.identityserver.com/articles/the-dangers-of-saml-idp-initiated-sso https://www.identityserver.com/articles/the-dangers-of-saml-...
- jcmfernandes 2y agoOIDC supports Initiating Login from a Third Party: https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin https://openid.net/specs/openid-connect-core-1_0.html#ThirdP... Unlike SAML's "take this assertion" IdP-initiated flow, OIDC went for a "start an authentication with this IdP, for this user, and send them back here". Much, much safer.