1

I'm reading about SAML Authentication and I've come across 2 different mechanisms. But I'm not seeing any proper explanation anywhere of which flow is used when.

If you're creating a SAML service provider application, then how do you decide which of these workflows to use in your SAML authentication flow?

  • SAML Request is sent through redirect code 302 --> Browser places a GET request
  • SAML Request is sent through HTTP Post through an HTML document/form

While designing an application, is this a purely subjective decision? Or does this depend upon something objective?

0

1 Answer 1

3

If all you're doing is sending a simple Authentication Request containing no data, then a GET resulting from a 302 redirect is sensible.

If, however, you are sending the Subject, you should probably use HTTP form POST instead. For example, if you captured the username so that you could decide which Identity Provider (IdP) to use, and are sending that username to the IdP for their use, then you should use POST. This is because when sending data, that data should be integrity-protected with a signature, and sending a signature in a GET means it is sent as a query parameter (just like the rest of the authentication request), allowing for the leakage of data in logs (intermediate proxies, etc.), as well as making the GET's URI ridiculously long.

In summary, yes, the decision is mostly subjective. However, because of what signatures do to the length of the SAML authentication request, if you are sending a Subject in the request, you should use POST.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .