Traditionally an SSO SAML request for the authentication works as follows:
- The user agent sends the request to the SP asking for some resource
- SP sends a SAML authentication request to IdP. This can be done using a HTTP-Redirect 302 or 303
- IdP authenticates the user (if not already done so..) and and sends a SAML response back to SP. If this leg uses HTTP-POST binding, the response is POSTed to SP as a form via the user agent.
- SP reads the SAML response and then...it does whatever it wants, regardless of the binding.
I have a couple of problems in understanding step#3 over here.
When the IdP sends a SAML response back, shouldn't it send it back to the user agent? Because that is where the request came from. If a browser makes a request to the server, the server has to give some response back to the user browser, isn't it?
AFAIK, SAML Idp and SAML SP don't communicate with each other directly. Isn't that being violated here if SP directly sends the SAML response to SP?
The second part - response is POSTed to SP as a form - is this the same mechanism through which the the request was also posted in the first place? AKA SP sent back an HTML file to the user agent which is used to POST a request to the IdP. And now IdP sends back an HTML file to the user agent which is used to POST a response back to the IdP?
Credits to @identigral for these steps from here: https://security.stackexchange.com/a/214198/282123
P.S: It will be great if you can reply in simple language please. There's a lot to learn and I'm trying to understand the basics first.