Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain completely state-less and not have to build a shared session cache.

  • 1
    I'd ask yourself one question: Is the client maintaining security information that drives access without server-side validation ever a good idea?
    – Andrew K.
    Feb 12, 2015 at 13:40
  • Sure, Google does it with JWT; buildings all over the world do it with keys and swipe cards. The admin validates you should have access to the building and programs your card with which rooms you should have access to and then gives it to you. You never again have to 'authenticate' to get access to those rooms.
    – cjbarth
    Feb 12, 2015 at 15:53
  • All of the building access systems I've ever used do not store the access list on the card, but in the access control system, sometimes cached at the point of presence. When you attempt to open the door, it either queries the control system for your rights to the door (if available) or uses its cache if not. They certainly never "reprogrammed" my card every time I needed access to a new location... As to Google's JWT... I suggest you reading up on their (or any) OAuth 2.0 implementation. It contains an identifier, but access is validated prior to allowing said access.
    – Andrew K.
    Feb 12, 2015 at 19:08
  • This question needs more information. I think what you are suggesting is horribly insecure and should not be done. The client cannot be trusted.
    – rook
    Feb 12, 2015 at 21:01
  • Definitely please add more context and information to your question. Also an architecture/flow diagram.
    – channel
    Mar 26, 2019 at 14:23

1 Answer 1


After reading more about SAML, OpenID, and JWT, it seems that encrypting the authentication and authorization payload in a JWT, which gets signed provides assurance that the data it contains is valid and untampered. That is the same level of protection that the tokens from SAML and OpenID use. After that, the same problems of token theft that apply to every session management system exist and there are well-known mitigations for that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .