发出POST请求后是否进入同一个SAML会话？

Question

There is a URL in which a SAML request is hidden. While making request, SAML authentication takes place. I would like to know if I will make the POST request to the hidden SAML URL with the same credentials as provided before. Will this session be the same as the one in which I have made the previous request.

PS: The machine, IPs and all are constant while making the requests.

Answer 1

Just like you open multiple tabs to access Google Docs, you would get multiple independent SAML sessions.

Each one would have different session ID and different Authentication Context.

For example, below are the two SAML responses with the same AWS IdP-init SSO SAML authentication flow.

<?xml
version="1.0"
encoding="UTF-8"
standalone="no"?>
<saml2p:Response
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
    Destination="https://signin.aws.amazon.com/saml"
    ID="_c5b2e49b9abcb559d5784487a2a4b419"
    IssueInstant="2019-03-04T00:27:36.738Z"
    Version="2.0">
    <saml2:Issuer
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://accounts.google.com/o/saml2?
        idpid=<idp_id>
    </saml2:Issuer>
    <saml2p:Status>
        <saml2p:StatusCode
            Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
        ID="_1ad7cff1e3c1000a8f112a1a43f35457"
        IssueInstant="2019-03-04T00:27:36.738Z"
        Version="2.0">
        <saml2:Issuer>https://accounts.google.com/o/saml2?
          idpid=<idp_id>
        </saml2:Issuer>      

<?xml
version="1.0"
encoding="UTF-8"
standalone="no"?>
<saml2p:Response
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
    Destination="https://signin.aws.amazon.com/saml"
    ID="_1a68f45a31b8abfde9850907cd65c25b"
    IssueInstant="2019-03-04T00:28:27.362Z"
    Version="2.0">
    <saml2:Issuer
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://accounts.google.com/o/saml2?
        idpid=<idp_id>
    </saml2:Issuer>
    <saml2p:Status>
        <saml2p:StatusCode
            Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
        ID="_f0b42fcf11de6279ffb1f890d50b57b2"
        IssueInstant="2019-03-04T00:28:27.362Z"
        Version="2.0">
        <saml2:Issuer>https://accounts.google.com/o/saml2?
            idpid=<idp_id>
        </saml2:Issuer>

As you can see the SAML Response ID is different between the two.