Red Hat Summit19.10. About SAML Web Browser Based SSO
PicketLink in JBoss EAP provides a platform to implement federated identity based services. This includes centralized identity services and Single Sign-On (SSO) for applications.
The SAML profile has support for both the HTTP/POST and the HTTP/Redirect bindings with centralized identity services to enable web SSO for your applications. The architecture for the SAML v2 based Web SSO follows the hub and spoke architecture of identity management. In this architecture an identity provider (IDP) acts as the central source (hub) for identity and role information to all the applications (Service Providers). The spokes are the service providers (SP).
Important
If one HTTP client (web browser) connects to more SPs pointing to the same IDP, the IDP does not distinguish between the different SPs. If more requests from one client come simultaneously, the IDP handles the most recent request from an SP and sends back SAML assertion about the authenticated user. It means the SAML response from the IDP can be in such case forwarded to incorrect SP. To get back to the older SP, you will need to reenter the SP URL in the browser.
Note
For more information, refer Red Hat JBoss Enterprise Application Platform 6.4 How to Setup SSO with SAML V2 document and Browser-based SSO Using SAML section in the Red Hat JBoss Enterprise Application Platform 6.4 Security Architecture document.
