I'm aware of how SAML is used for single sign on (SSO). That is, redirection to IDP from SP and getting the user's identity from the SAML response/assertion.

My question is: Does SAML 2.0 specification define how to pass username and password as part of a SAML request XML for authentication? Note that I'm not talking about single sign on and just want authentication of username/password.

1 Answer 1


SAML does not support sending a username and password to the identity provider from the service provider. There is an AuthnRequest (authentication request) that may be sent from the SP, that starts a session at the SP, and tells the IdP, "hey, I don't know who this user is - authenticate them, and then respond back to this location, with the user's identity, and pass me this RelayState to let me know what session to associate the user with."

What you're asking about (a service provider passing a username/password directly to the identity provider and retrieving an assertion) is a function of an STS, or Security Token Service. A very common STS implementation is WS-Trust, which does commonly "wrap" a SAML Assertion token in the response.

  • Thanks. Yes, for a scenario involving ADFS, I've been authenticating the user using the idp initiated sign on url.
    – ksrini
    Jun 7, 2016 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .