AuthNRequest

The SAML AuthNRequest (Authentication Request) is the message sent by the Service Provider (SP) to the Identity Provider (IdP) to initiate the SSO process.

SAML Redirect Binding

In the redirect binding, the AuthNRequest is sent via URL query parameters. The request is deflated, base64-encoded, and URL-encoded before being appended to the IdP’s SSO URL.

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                    ID="_809707f0030a5d00620c9d9df97f627afe9dcc24"
                    Version="2.0"
                    IssueInstant="2014-09-22T13:42:00Z"
                    Destination="https://idp.example.com/SSOService.php"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    AssertionConsumerServiceURL="https://sp.example.com/demo1/index.php?acs">
    <saml:Issuer>https://sp.example.com/demo1/metadata.php</saml:Issuer>
    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                        AllowCreate="true"/>
    <samlp:RequestedAuthnContext Comparison="exact">
        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

SAML POST Binding

In the POST binding, the AuthNRequest is sent as a base64-encoded value in a hidden form field. The form is automatically submitted to the IdP’s SSO URL via JavaScript.

Key Elements

For interactive SAML tools, visit SAMLTool.com.