0

When an SAML Authentication request is performed, let's say that the Service Provider uses an HTTP 302 redirect. The user agent is redirected to the IdP via a GET request. This URL is provided by the SP.

In this case, is the request:

  • Of type XML, and
  • is it signed, and/or
  • encrypted?

Because as per my current understanding SAML authentication becomes secure if it's encrypted and/or signed.

Additionally, if all these 3 things are true then does it matter that a URL could easily exceed 2048 characters?

Improve this question

1 Answer 1

Reset to default
1

For a detailed answer, you should refer to the "Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0" specification.

In summary, the SAML authn request XML is encoded using the DEFLATE compression mechanism. In addition, the authn request doesn't include an XML signature. Instead, there's an HTTP-Redirect specific signature mechanism. These steps are taken to avoid any browser URL length limitations.

SAML authn requests aren't encrypted. Privacy is provided at the transport level by using HTTPS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .