Question

I am creating simple service provider (SP) on java with wso2 saml sso authorization.

I implemented it in this way (please correct me, if I’m wrong):

1. User inputs some target Url in browser
2. My SP’s servlet sends redirect to WSO2 IDM.
3. IDM authorizes the user and redirect to my Consumer Url with
   SAMLResponse and RelayState parameters.

Now SP must process this request and redirect user to target Url without redirection to IDM again. Otherwise I’ll get the infinite loop, so I think that between step 1 and step 2 should be one more step…

What is the proper way to do this?

Answer 1

Typical implementation

1 User tries to access a protected site

2 A filter checks if the user has an authenticated session.

2.1 If not, redirect to IDP/IDM

2.1.1 IDM authenticates user and redirects back to SP with identity proof

2.1.2 SP creates authenticated session

2.1.3 User is redirected to target URL everything start from 2 again.

Here I have a post describing the flow in more detail