I'm required to integrate my website with SAML authentication, so that any login done to my website, the credentials will be validated by a specific idp (known in advance)
Even after reading many articles about it, Incl. the official technical documentation, I have many open questions:
Can it be automated? i.e, my website is the SP, and I know what IDP I need to authenticate against, can I somehow leave my site as it is, and use the already entered credentials and authenticate them infront of the IDP? Somehow do the authentication myself in the backend, instead of redirecting the user? Is it somehow resembles ECP (Enhanced Proxy)? Is it different mechanism between shibboleth, Okta or do they all follow the same protocol and behavior?
Are all IDP supported servers the same? Or can one decide any authenticaion method he likes to use?
- Assuming #1 is possible, How can I authenticate that the response I got is indeed from who it claims it is (avoid MITM)?