SAML2.0 SSO with the WSO2 Identity Server?

Question

I need to use WSO2 Identity server with SAML for SSO for my internal application. I came across this beautiful SAML2.0 SSO with the WSO2 Identity Server article

But i have two questions on this article which i am not sure how works

1) In 5th step it is said "Now the user is being redirected to IDP again. Now the IDP realize this user is already authenticated hence it would issue a SAML Assertion without prompting any authentication challenge."

How will the IDP realize that user is already authenticated ?

As per my understanding it must be done based on session. Does it mean when authentication request goes from service provider 1 to Identity server (SP1 redirects the request to IS thru browser ), IS will first authenticate the credentials and if successful keep the user object under session.

Now when second authentication request goes to IS thru SP2, same session ID is sent (provided request is sent from another of same browser), IS fins already a user object associated with this session, so trust him. Is this understanding correct?

2)In step 2 it is said that " Now the SP1 can validate the SAML Assertion issued by IDP and let the user log-in. " what is the specific field/value (under SAML response sent by IP) , SP1 will verify?

3) Where user credentials are stored. Is it on IS side or Service provider side?

Answer 1

Just explain how it works with WSO2IS 5.0.0

1. When user is authenticated to IDP by providing credentials. WSO2IS creates an authenticated session for user and cookie with is associated with the authenticated session set in to the user's browser. Cookie name would be commonAuthId . you can also find it in your browser once you are authenticated with WSO2IS using SSO. Then user is trying to access another SP using same browser, cookie would be sent in to the WSO2IS and it identifies that there is an authenticated session related to the cookie.

2. Usually, SP validates the SAML2 Response and Assertion. There are several validations that you can do. But most common would be

   • Signature of the SAML2 Response and SAML2 Assertion

   • Validity period SAML2 Response and SAML2 Assertion.

   • Audience restriction validation in SAML2 Assertion

   • Destination url and Recipient value

Normally Username would be extracted from the Subject identifier value. Also there may be attributes in the attribute statement, which SP can retrieve and do some validation over them as well.

3. End users are authenticated to the IDP. So credentials must be in IDP not with the SP. It is one of idea of SSO. Maintains the credentials in one place. WSO2IS is default shipped with LDAP based user store. Therefore end user credentials are stored in the LDAP server. However WSO2IS can be deployed with any existing user stores that you like