SAML 元数据文件和 SSO

Question

Aim

To navigate to a url using SSO.

Info

I have been given a SP SAML metadata file by a third party.

Question

Using Java & JavaScript, how do I navigate to the endpoint url?

I have seen a number of articles on SAML architecture , but cannot seem to find how to just navigate to an endpoint. I presume this could even be tested in Postman just like a JWT can.

More info

I am new to SAML, but have been reading up on the topic. From what I can tell, is I am the 'Principal' and the third-party is the 'Service Provider'. It looks like they used onelogin to generate the SP metatdata file.

eg

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2020-10-14T14:43:29Z" cacheDuration="PT604800S" entityID="https://testentityid">
  <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>certificate</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>certificate</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://logoutendpoint"/>
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://consumeendpoint" index="1"/>
  </md:SPSSODescriptor>
</md:EntityDescriptor>

Answer 1

The Principal is the user the IdP is authenticating. A simple flow is essentially, using the SAML Web Browser SSO Profile :

1. User goes to a resource at a Service Provider (SP)
2. The SP detects the user has no session and redirects the browser to the SSO endpoint of the IdP
3. The IdP authenticates the user (Principal)
4. The IdP redirects the browser to the SP's AssertionConsumerService URL along with a SAML Response encoded in the URL, which contains the Principal's SAML Attributes.

There are various SAML Request/Response examples here and various ways of the SP redirecting the browser, either via GET or POST SAML binding. Plus a lot of other essentials such as certificates and signatures based on keys in the metadata of each entity (IdP and SP).

Normally you have to sign a SAML Request using your private key and the other entity (IdP for example) verifies that signature using your public key from your SAML metadata, <md:KeyDescriptor use="signing">/X509Data/X509Certificate above. An unsolicited SAML Response sent to an SP may not be relevant but it would need to be signed with the private key of the IdP and the SP would need to have the public key of the IdP to verify the signature.