SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) that authenticate against the IdP via saml protocol, is there something the application could use in the saml response from the IdP to pass to the Permission Service Provider to authenticate the request?

In an OAuth2 world I presume this is done via the OAuth token but I am unfamiliar with SAML.

  • No, Saml responses are intended for the service provided which requested them through a Saml request. And the SP should verify this through correlation IDs. This to prevent attacks through stolen assertions. Sep 3, 2019 at 4:33
  • Does that mean SAML doesn't have federated tokens between SPs?
    – James Lin
    Sep 3, 2019 at 22:32
  • is that mean that "re-use the SAML assertion" its not possible ? In my case i need to get the Token and re-use it REST API
    – Imen
    Jan 10, 2020 at 10:12

1 Answer 1


Just did a bit more digging, found something call ”SAML 2.0 federation“, according to the wiki about ADFS and IBM doc it's a built in feature.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .