19.10. About SAML Web Browser Based SSO

download PDF
PicketLink in JBoss EAP provides a platform to implement federated identity based services. This includes centralized identity services and Single Sign-On (SSO) for applications.
The SAML profile has support for both the HTTP/POST and the HTTP/Redirect bindings with centralized identity services to enable web SSO for your applications. The architecture for the SAML v2 based Web SSO follows the hub and spoke architecture of identity management. In this architecture an identity provider (IDP) acts as the central source (hub) for identity and role information to all the applications (Service Providers). The spokes are the service providers (SP).


If one HTTP client (web browser) connects to more SPs pointing to the same IDP, the IDP does not distinguish between the different SPs. If more requests from one client come simultaneously, the IDP handles the most recent request from an SP and sends back SAML assertion about the authenticated user. It means the SAML response from the IDP can be in such case forwarded to incorrect SP. To get back to the older SP, you will need to reenter the SP URL in the browser.


For more information, refer Red Hat JBoss Enterprise Application Platform 6.4 How to Setup SSO with SAML V2 document and Browser-based SSO Using SAML section in the Red Hat JBoss Enterprise Application Platform 6.4 Security Architecture document.
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.