1

Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On?

By looking at the specs, I see references to various elements that to me indicate an affirmative response to the previous question, namely:

  1. protocol:AuthnRequest/Issuer
  2. protocol:AuthnRequest/AssertionConsumerServiceURL
  3. metadata:EntityDescriptor/AssertionConsumingService

And possibly others.

Background

The question might be naive to the expert, but I'm not an expert on the specific topic, and I'm trying to get an authoritative response because it concerns a fairly hot issue going on in Italy at the moment. It's being discussed, within the government, whether to enforce a SPID-based authentication scheme upon the many private social networks available in Italy, like Facebook, TikTok and the like.

SPID is a nationwide SAML-based authentication scheme citizens can use to identify themselves with internet-provided public services. Citizens are able to use SPID only after registering themselves with a state-approved Identity Provider using their own official identity documents (ID card, passport, and the like).

My concern is that enforcing the use of SPID with private social networks, not only anonymity will get thrown out of the window, but also that the state Identity Provider will be able to know which Services the User is accessing, thus profiling citizens, their habits and all that comes with it in terms of respect of (human) rights.

1

For SAML based SSO to work, the Identity Provider and Service Provider have to communicate and know of each other. I looked at this Stack Overflow post previously for the difference between SAML and OpenID which restates this and elaborates far more on the topic. I'm not a chief engineer implementing SAML based processes or anything so cannot claim to be truly authoritative on the subject, but anything I have read details communication between both the idP and service provider.

As an example authentication process, the user would contact the service provider who would then contact the identity provider, which would then supply a SAML assertion to the service provider. This to my knowledge will involve both parties knowing of each other and being able to record the sign on process.

3

This image helped me understand, immensely.

enter image description here

The short of it is that, yes the SP needs to know the IdP. It's totally up to the IdP what information they send the SP, during the auth exchange, but there need to be an initial exchange of public key/signature information between the two.

Source: We're starting to onboard enterprise and need the SSO.

Image from Okta

3
  • 1
    Oh dang, my bad- didn't even think about it. It's from okta but I am not in any way affiliated with them. Will add the link.
    – chrispy
    Feb 7 at 15:52
  • Thanks for the reply, which confirms my understanding. As an added info, one of the people who's pushing for this change stated that with a double-blind approach any privacy issue would be avoided, but it's my understanding that in that case there'd still be an authority that'd be able to match Users with their preferrend SP's, just shifting the problem from the IdPs proper to what in literature is named "Id Exchange".
    – Fabio A.
    Feb 14 at 21:55
  • Oh, one more thing. I will accept the other answer just because it came first. Yours was very informative as well. Thanks.
    – Fabio A.
    Feb 14 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.