Federation Manager Guide › Federation Partnerships › Web Links to Initiate Single Sign-on › SP-initiated SSO (SAML 2.0)

SP-initiated SSO (SAML 2.0)

SP-initiated SSO requires that you have an HTML page at the Service Provider containing hard-coded links to the AuthnRequest service at the Service Provider. These links redirect the user to the Identity Provider to be authenticated and determining what is included in the AuthnRequest itself.

This information applies to Artifact or POST bindings.

The hard-coded link that the user selects must contain specific query parameters, which are used in an HTTP GET request to the AuthnRequest service.

Note: The page with these hard-coded links has to reside in an unprotected realm.

To specify the use of artifact or profile binding for the transaction, the syntax for the link is:

http://sp_server:port/affwebservices/public/saml2authnrequest?
ProviderID=IdP_ID&ProtocolBinding=URI_of_binding&
RelayState=target_URL

• sp_server:port

  Specifies the server and port number at the Service Provider that is hosting Federation Manager.

• IdP_ID

  Specifies the identity assigned to the Identity Provider.

• URI_of_binding

  Identifies the URI of the POST or Artifact binding for the ProtocolBinding element. The SAML 2.0 specification defines this URI.

  • The URI for the artifact binding, as specified by the SAML 2.0 specification is:

    urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact

  • The URI for the POST binding, as specified by the SAML 2.0 specification is:

    urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

    You do not need to set this parameter for HTTP-POST single sign-on.

  A binding must also be enabled for the partnership for the request to work.

• target_URL

  Specifies the URL of the federation target at the Service Provider.

Note the following:

• If you do not include the ProtocolBinding query parameter in the AuthnRequest link, the default binding used is the one defined for the partnership. If you have both bindings defined in the partnership, then no binding is passed in the AuthnRequest. As a result, the default binding defined at the Identity Provider is used.
• If artifact and POST are enabled for the partnership but you only want to use artifact binding, include the ProtocolBinding query parameter in the link.