0

SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) that authenticate against the IdP via saml protocol, is there something the application could use in the saml response from the IdP to pass to the Permission Service Provider to authenticate the request?

In an OAuth2 world I presume this is done via the OAuth token but I am unfamiliar with SAML.

Improve this question
3
  • No, Saml responses are intended for the service provided which requested them through a Saml request. And the SP should verify this through correlation IDs. This to prevent attacks through stolen assertions. – Geir Emblemsvag Sep 3 '19 at 4:33
  • Does that mean SAML doesn't have federated tokens between SPs? – James Lin Sep 3 '19 at 22:32
  • is that mean that "re-use the SAML assertion" its not possible ? In my case i need to get the Token and re-use it REST API – Imen Jan 10 '20 at 10:12
1

Just did a bit more digging, found something call ”SAML 2.0 federation“, according to the wiki about ADFS and IBM doc it's a built in feature.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.