Forum Discussion

tharrington_184's avatar
tharrington_184
Icon for Nimbostratus rankNimbostratus
Jan 27, 2015

Reusing SAML assertion

I am implementing single sign on with multiple SPs. Here is my basic understanding:

 

1) Browser(User) requests resource from Service Provider (SP).

 

2) SP Redirects (with SAML Request) to Identity Provider (IdP - f5 APM).

 

3) Since it is first login, User gives the (IdP) his/her valid credentials.

 

4) IdP then redirects Browser (with SAML Response which includes SAML token) to the SP page.

 

 

Now let's say I have Service Provider A and Service Provider B. A user has completed the step about for Service Provider A. From service provider A (salesforce.com in my scenario), I have written a server-side method which instantiates a callout to an endpoint on Service Provider B (Sharepoint API). Is it possible to re-use the SAML assertion in this case? I.e. will service provider B trust the backend method?

 

6 Replies

  • What do you mean by the back-end method? Is the request/callout initiated from Salesforce.com to SP B? I really would like to see a more detailed description of the flow and the use case here. Thanks!

     

    • tharrington_184's avatar
      tharrington_184
      Icon for Nimbostratus rankNimbostratus
      Yes, the request is initiated from the Salesforce.com server to SP B.
    • Michael_Koyfma1's avatar
      Michael_Koyfma1
      Icon for Cirrus rankCirrus
      Unfortunately, it does not look like it will be possible to achieve this.
  • What do you mean by the back-end method? Is the request/callout initiated from Salesforce.com to SP B? I really would like to see a more detailed description of the flow and the use case here. Thanks!

     

    • tharrington_184's avatar
      tharrington_184
      Icon for Nimbostratus rankNimbostratus
      Yes, the request is initiated from the Salesforce.com server to SP B.
    • Michael_Koyfman's avatar
      Michael_Koyfman
      Icon for Cirrocumulus rankCirrocumulus
      Unfortunately, it does not look like it will be possible to achieve this.