I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity provider. In my case however, is it ok for the service provider to pass user credentials to the identity provider directly? The auth server will in turn return a SAML assertion to the application server.
Edit: Also is it a good practice to separate the application server from the authentication server? In this case, my authentication logic will be complex and I want to abstract this.