Federation Security Services Guide › Authenticate SAML 2.0 Users at the Service Provider › SAML 2.0 Authentication Scheme Overview › SAML Authentication Request Process

SAML Authentication Request Process

The following illustration shows how the SAML 2.0 authentication scheme processes requests.

Note: The SPS federation gateway can replace the Web Agent and Web Agent Option Pack to provide the SiteMinder Federation Web Services application functions. For information about installing and configuring the SPS federation gateway, see the CA SiteMinder Secure Proxy Server Administration Guide.

The functional flow for authentication is as follows:

1. A user's browser makes a request for a Service Provider resource. This request goes to the AuthnRequest service at the Service Provider. The request is then redirected to the Identity Provider to obtain a SAML assertion.
2. The Identity Provider returns a response to the Service Provider.

   In the case of the HTTP-POST binding, the response contains the assertion. For the HTTP-Artifact binding, the response contains a SAML artifact.

3. The Assertion Consumer Service at the Service Provider receives the response message and determines whether the POST or Artifact binding is being used.

   If the artifact binding is being used, the Assertion Consumer Service sends the artifact to the Identity Provider to obtain a response that contains the actual assertion. The Assertion Consumer Service sends the response with the assertion as credentials to the Policy Server.

4. The Policy Server invokes the SAML 2.0 authentication scheme by passing the response message with the user credentials to the scheme to be authenticated.
5. The user disambiguation process begins.
6. After the disambiguation phase is complete, the SAML 2.0 authentication scheme validates the credentials in the assertion, validates the assertion itself for time validity, and, if applicable, verifies if the assertion was signed by a trusted Identity Provider.

   Note: For the POST binding, a signature is required and there must be certificate lookup information supplied. If a signature is not present, authentication fails. However, for the Artifact binding, a signed assertion is optional because the assertion response is obtained over a secure channel between the Service Provider and Identity Provider.

   If Single Logout is enabled, the user is redirected by the SLO servlet to a No Access URL.