Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO.

If the IdP gets an <AuthnRequest> from the SP, should / must / can the IdP do the user authentication first, or read/validate the <AuthnRequest> first?

(the implementation we have in mind could be based on IBM's WebSeal and TFIM... where it seems the User is redirected to authenticate BEFORE the TFIM actually looks at the <AuthnRequest>. At least, if I'm properly understanding the docs)

Edit: My Context also includes that the User is not yet locally authenticated at the IdP, when the SP's <AuthnRequest> is received at IdP.


The Authnrequest should be validated first check signatures, timestamps and so on. Plus the AuthnRequest can contain information on how the user should be authenticated so logically reading the AuthnRequest comes first.

| improve this answer | |

I do not have any knowledge about WebSeal or TFIM but as far as SAML is concerned validation has to be carried out first.

SAML is a means of communication. A language used by web services to talk to each other. Validating the incoming request is essential to make sure that correct grammar and syntax is followed.

An AuthnRequest is nothing but an XML message which may contain details like:

  1. A request identifier
  2. time stamp
  3. Request Issuer details (You need to know who you are communicating with)
  4. The redirect URL after authentication
  5. XML signature (very important to check the authenticity and integrity of the message )
  6. Replay token

Of course the first thing to do after on receiving an AuthnRequest is to validate the XML schema. Validating the other fields is important before presenting the log in page to the client in order to filter out the forged,non-standard and replayed requests.

P.S. One more important point. SAML also provides SSO. Let us say a user is already using a service and is authenticated with the IdP. If he wishes to use another service a new SAML AuthnRequest will be sent to the IdP. In this case after validating the request an assertion should be generated without presenting a login page to the user to enable direct login.

| improve this answer | |
  • Thx. I understand that a forged SAMLRequest must result in NOT sending out a successful SAMLResponse. But must it also result in not asking the user to locally authenticate at the IdP? – Fred H Sep 19 '13 at 9:29
  • @FredH if its a forged/replayed/malicious request there is no point in allowing the client to go further into the system. – Shurmajee Sep 19 '13 at 9:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.