3 ms·

This article is confusing in some parts. It should highlight one very interesting bit : there are no direct TCP connections between the SP and the idp. Everythi

This article is confusing in some parts. It should highlight one very interesting bit : there are no direct TCP connections between the SP and the idp. Everything flows through the user. SAML is perfectly suitable for offline services (network equipement with web frontend, for instance)

rb12345 2y ago
That's true for SAML2, but not SAML1 - not that anything should be using SAML1 these days.
- honzaik 2y ago
  Well that depends on the binding right? In case you use the "artifact binding" then theres also direct communication between SP and IdP. I havent seen it in the wild and I am also no professional, but I saw it in the 2.0 standard, e.g., see https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.3.SP-Initiated%20SSO:%20%20POST/Artifact%20Bindings|outline https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-...
  - jf 2y ago
    It’s hard enough to debug SAML as it is, I can’t imagine debugging artifact binding without having full control of both the SP and IdP.