Using SAML and https or http -
i working on service provides authentication service using saml sso protocol communication security.
brief intro :- saml sso recognizes identity provider (ip or idp) , service provider, “trusts” , delegates user authentication idp. here how trust established: 1. service provider (sp): - trusted idp name , certificate - single sign on (sso) url 2. identity provider (idp): - relying sp name , certificate - sso consumer url whenever sp needs authenticate user, redirects sso endpoint , passes samlrequest wither in query string or form field (get or post method).
what know is requirement client requires authentication should sending request through "https" protocol or request can relayed across using http channel. asking saml protocol mandates use https or not
saml not require use of https. should protect messages in way. might using xml signature/encryption, https or other way. https easiest way implement this.
Comments
Post a Comment