SAML and privacy: does the Identity Provider have to know about the Service Provider?

Question

Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On?

By looking at the specs, I see references to various elements that to me indicate an affirmative response to the previous question, namely:

1. protocol:AuthnRequest/Issuer
2. protocol:AuthnRequest/AssertionConsumerServiceURL
3. metadata:EntityDescriptor/AssertionConsumingService

And possibly others.

Background

The question might be naive to the expert, but I'm not an expert on the specific topic, and I'm trying to get an authoritative response because it concerns a fairly hot issue going on in Italy at the moment. It's being discussed, within the government, whether to enforce a SPID-based authentication scheme upon the many private social networks available in Italy, like Facebook, TikTok and the like.

SPID is a nationwide SAML-based authentication scheme citizens can use to identify themselves with internet-provided public services. Citizens are able to use SPID only after registering themselves with a state-approved Identity Provider using their own official identity documents (ID card, passport, and the like).

My concern is that enforcing the use of SPID with private social networks, not only anonymity will get thrown out of the window, but also that the state Identity Provider will be able to know which Services the User is accessing, thus profiling citizens, their habits and all that comes with it in terms of respect of (human) rights.

Answer 1

For SAML based SSO to work, the Identity Provider and Service Provider have to communicate and know of each other. I looked at this Stack Overflow post previously for the difference between SAML and OpenID which restates this and elaborates far more on the topic. I'm not a chief engineer implementing SAML based processes or anything so cannot claim to be truly authoritative on the subject, but anything I have read details communication between both the idP and service provider.

As an example authentication process, the user would contact the service provider who would then contact the identity provider, which would then supply a SAML assertion to the service provider. This to my knowledge will involve both parties knowing of each other and being able to record the sign on process.

Answer 2

This image helped me understand, immensely.

The short of it is that, yes the SP needs to know the IdP. It's totally up to the IdP what information they send the SP, during the auth exchange, but there need to be an initial exchange of public key/signature information between the two.

Source: We're starting to onboard enterprise and need the SSO.

Image from Okta