I do not have any knowledge about WebSeal or TFIM but as far as SAML is concerned validation has to be carried out first.
SAML is a means of communication. A language used by web services to talk to each other. Validating the incoming request is essential to make sure that correct grammar and syntax is followed.
AuthnRequest is nothing but an XML message which may contain details like:
- A request identifier
- time stamp
- Request Issuer details (You need to know who you are communicating with)
- The redirect URL after authentication
- XML signature (very important to check the authenticity and integrity of the message )
- Replay token
Of course the first thing to do after on receiving an
AuthnRequest is to validate the XML schema. Validating the other fields is important before presenting the log in page to the client in order to filter out the forged,non-standard and replayed requests.
P.S. One more important point. SAML also provides SSO. Let us say a user is already using a service and is authenticated with the IdP. If he wishes to use another service a new SAML AuthnRequest will be sent to the IdP. In this case after validating the request an assertion should be generated without presenting a login page to the user to enable direct login.