多SP与单一IDP的SAML SSO登录及断言提交问题

Great question! Let’s walk through how to handle IDP-initiated SSO across multiple service providers with a shared identity provider—this is a common scenario, and there are clear steps to make that seamless cross-SP login work.

You can’t send users directly to the second SP’s regular landing page (that would trigger SP-initiated SSO and prompt them to log in again). Instead, you need to trigger an IDP-initiated SSO flow targeted specifically at the second SP. Here’s how to structure that link:

• First, confirm your IDP has the second SP’s metadata fully configured: entity ID, Assertion Consumer Service (ACS) URL, signing certificate, and any required attributes.
• Build a request to your IDP’s SSO endpoint, including parameters that tell the IDP which SP to target:
  • entityID: The unique identifier of the second SP as registered in your IDP (this is the most critical parameter).
  • RelayState: Use this to pass the specific page in the second SP you want the user to land on post-authentication (e.g., their dashboard, a specific feature page).

Example of a valid IDP-initiated link for the second SP:

https://your-idp-domain.com/sso-endpoint?entityID=second-sp-unique-id&RelayState=https://second-sp-domain.com/user-dashboard

When the user clicks this link, the IDP checks their active session (since they already authenticated via the first SP) and skips re-authentication, moving straight to generating an assertion for the second SP.

Once the IDP generates the SAML assertion for the second SP, the submission process is usually handled automatically by standard SAML libraries, but here’s what’s happening (and how to do it if you’re building a custom implementation):

• The IDP creates a signed SAML Response XML containing the user’s attributes, session validity, and SP-specific claims. It signs this response with its private key so the second SP can verify its authenticity.
• The IDP sends this response to the second SP’s ACS URL via an HTTP POST request (the standard method, since assertions can be too large for URL parameters in a redirect).
• For custom implementations, you’ll need to build an auto-submitting HTML form to send the assertion:

  <form method="POST" action="https://second-sp-domain.com/acs">
    <input type="hidden" name="SAMLResponse" value="BASE64_ENCODED_SAML_RESPONSE">
    <input type="hidden" name="RelayState" value="https://second-sp-domain.com/user-dashboard">
    <p>Redirecting to your service... If nothing happens, click <button type="submit">here</button>.</p>
  </form>
  <script>
    // Auto-submit the form to complete the SSO flow
    document.forms[0].submit();
  </script>
  

  The second SP will receive the SAMLResponse, validate its signature, extract the user’s identity, and log them into the requested page.

• Session Consistency: Ensure your IDP maintains a single, centralized user session. All SPs should rely on this IDP session—never let individual SPs create their own separate sessions that aren’t synced.
• Metadata Accuracy: Double-check that each SP’s ACS URL and entity ID in the IDP match exactly what the SP expects. Even a minor typo will break the SSO flow.
• Security Validation: On the second SP side, always validate the RelayState parameter to prevent open redirect attacks. Only allow URLs that belong to your SP’s domain.
• Signing & Encryption: Enable assertion signing (required for most enterprise SPs) and encrypt sensitive user attributes if your use case demands it.

内容的提问来源于stack exchange，提问作者sudhansu rana