We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when authentication succeeds. Its important to note that S2 has no connection to any Idps, it relies solely on S1.

In a sense this is a service-to-service authentication, is there an existing mechanism on SAML2 to achieve this? I can also make S2 an SP so it becomes an SP-to-SP if it makes things easier.

1 Answer 1


SAML doesn't support SP to SP communications.

In your scenario S1 would act as an SP to the IdPs, as is currently the case, and as an IdP to S2. In other words, S1 would be a proxy.

The flow would be:

  1. S2 SSOs to S1 (acting as an IdP).
  2. S1 (acting as an SP) SSOs to IdP.
  3. IdP returns SAML response to S1 (acting as an SP).
  4. S1 (acting as an IdP) returns a new SAML response to S2.

The claims in the SAML response sent to S2 would be based off the claims received in the SAML response from the IdP.

  • I was trying to avoid having to setup an IdP. What if S2 remains just a regular service and after the SSO flow from S1, user redirects to S2 with the same AuthRespone which tells S1 authentication succeeded. In drawback to this callback url approach?
    – Marconi
    Aug 1, 2023 at 12:46
  • That might work although, in my opinion, it's not as a clean a solution. Aug 1, 2023 at 21:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .