I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service provider will query the identity provider. Based on this link -- https://developers.onelogin.com/saml , the service provider identifies the identity provider based on "application subdomain, user IP address, or similar." My question is, what prevents the identity provider from acting maliciously and saying, "Sure, this user has access. Let them in!" I mean, I could just set up my own identity provider and if I'm identified by IP address, couldn't I just pretend that this user has access?
The identity provider selection would be from a list of trusted identity providers with which the service provider application has already exchanged certificates or configured known metadata URL.
So yes, you could set up your own identity provider, but it would have to be a very badly-written service provider application that would redirect to you and trust your SAML assertions if you were not already in their configured list or otherwise known to them (e.g. a Federation setup).
No because the application is only configured to use the identity provider specified in the code the devs wrote.