Security Assertion Markup Language (SAML) 2.0 supports two single sign-on (SSO) flows: identity provider (IdP)-initiated and service provider (SP)-initiated. The flow used by a federation depends on where the user begins the authentication process.
In an IdP-initiated flow, the user starts at the RapidIdentity portal, selects the
application icon, and is redirected to the service provider with a SAML response. The
service provider does not send an AuthnRequest to RapidIdentity.
In an SP-initiated flow, the user starts at the service provider, which sends an
AuthnRequest to RapidIdentity. RapidIdentity authenticates the user and returns a SAML
response to the service provider.
SP-initiated SSO is recommended, as SP-initiated SSO supports authentication
context controls such as ForceAuthn and
RequestedAuthnContext, which allow the service provider to
request specific authentication behavior. IdP-Initiated SSO does not support these
controls and provides less control over the authentication context.
Both flows use the RelayState parameter to direct the user to a
specific resource at the service provider after authentication.