4 ms·
That's true for SAML2, but not SAML1 - not that anything should be using SAML1 these days.
by rb12345 2y ago
That's true for SAML2, but not SAML1 - not that anything should be using SAML1 these days.
- honzaik 2y agoWell that depends on the binding right? In case you use the "artifact binding" then theres also direct communication between SP and IdP. I havent seen it in the wild and I am also no professional, but I saw it in the 2.0 standard, e.g., see https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.3.SP-Initiated%20SSO:%20%20POST/Artifact%20Bindings|outline https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-...
- jf 2y agoIt’s hard enough to debug SAML as it is, I can’t imagine debugging artifact binding without having full control of both the SP and IdP.