Federation Security Services Guide › Identify Service Providers for a SAML 2.0 Identity Provider › Set Up Links at the IdP or SP to Initiate Single Sign-on › Service Provider-initiated SSO (POST or artifact binding)

Service Provider-initiated SSO (POST or artifact binding)

If a user visits the Service Provider first and then goes to an Identity Provider, you have to create an HTML page at the Service Provider containing hard-coded links to the AuthnRequest service at the Service Provider. These links redirect the user to the Identity Provider to be authenticated as well as determining what is included in the AuthnRequest itself.

The hard-coded link that the user selects must contain specific query parameters. These parameters are supported by an HTTP GET request to the AuthnRequest service at the Service Provider's Policy Server.

Note: The page with these hard-coded links has to reside in an unprotected realm.

To specify the use of artifact or profile binding for the transaction, the syntax for the link is:

http://SP_server/affwebservices/public/saml2authnrequest?ProviderID=IdP_ID&
ProtocolBinding=URI_of_binding

• sp_server:port

  Specifies the server and port number at the Service Provider that is hosting the Web Agent Option Pack or the SPS federation gateway.

  • IdP_ID

  Specifies the identity assigned to the Identity Provider

• URI_for_binding

  Identifies the URI of the POST or Artifact binding for the ProtocolBinding element. This URI is defined by the SAML 2.0 specification.

A binding must also be enabled for the SAML authentication scheme for the request to work.

Note the following:

• If you do not include the ProtocolBinding query parameter in the AuthnRequest link, the default binding used is the one defined for the authentication scheme. If you have both bindings defined in the authentication scheme, then no binding is passed in the AuthnRequest. As a result, the default binding defined at the Identity Provider is used.
• If artifact and POST are enabled for the SAML authentication scheme, but you only want to use artifact binding, you must include the ProtocolBinding query parameter in the link..