CODEWITHSUNDEEP
authenticationsaml
javafoot
javafoot

Reputation: 11

SAML redirects each SP request to IDP for checking authentication after successful IDP authentication?

This article shows the process of SAML authentication the first time: https://developers.google.com/google-apps/sso/saml_reference_implementation

My App is compliant with it currently. But, the request is redirected to IDP for authentication when a user clicks links on a page provided by SP. A user can clearly see the IDP URL in the address bar and feels slow.

My Case: SP is located on Jetty, IDP is located on Jboss6.2, they are all behind Apache using the same domain name.

I am using picketlink2.6 with SAML POST binding.

I want to know if:

  1. This is what SAML designed?
  2. I should stop this redirection to IDP, and only check the authentication on the local SP? I feel this disadvantage is evident -- App A can't know a user is logged out when the user logged out in App B.
  3. how to speed up the redirection?

Upvotes: 0

Views: 581

Answers (1)

Anders Abel
Anders Abel

Reputation: 69260

  1. No, SAML is meant to be used to authenticate the initial request. Then you should establish a session in the SP application. This is normally done by a session authentication cookie.
  2. If you need that, there is support in the SAML standard för Single Logout, which will make sure that a logout terminates all sessions in all SPs and in the Idp.
  3. You won't have to if it only occurs the first time.

Upvotes: 1

Related Questions