Get isInResponseTo before calling SAMLServiceProvider.ReceiveSSO

SAML for ASP.NET
1

Hello ComponentSpace,
There is the next situation: our application acts as SP with a multi-tenancy structure and we would like to support both SP-initiated and IdP-initiated SSO. In the case with SP-initiated we do not have any issues as SAMLController.ConfigurationID is set up before SAMLServiceProvider.InitiateSSO and stay the same after receiving SSO Response. But there is an issue with IdP-initiated as we do not know how to get the needed ConfigurationID. I checked “Configuration Documentation” and found several solutions:

• Separate subdomain names for each tenant - not applicable for us as we do not have subdomains
• Query string parameter - possible solution but as we allow to use the same IdP configuration across different tenants it is not possible to say IdP what exact tenant name should be sent with response as one IdP could access different tenants
• Special HTTP headers or cookies - the same thing as for previous one
• IP address ranges - not applicable for us

So, we decide to show users a page after receiving IdP response (in case of IdP-initiated flow) where they will choose what tenant they would like to access. In this case, we need to know whether it is IdP-initiated or SP-initiated flow before trying to read SSO Response. Could you please say whether it is possible to Get isInResponseTo before calling SAMLServiceProvider.ReceiveSSO or you could advise any other possible solutions.

Best Regards
Dmitry

2

Hi Dmitry,

The isInResponseTo output parameter isn’t available until after the call to SAMLServiceProvider.ReceiveSSO returns.

However, you can call SAMLServiceProvider.IsSSOCompletionPending(), prior to calling SAMLServiceProvider.ReceiveSSO, to determine whether this is IdP-initiated or SP-initiated SSO.

SAMLServiceProvider.IsSSOCompletionPending() returns true if this is SP-initiated SSO (ie there’s been a previous call to SAMLServiceProvider.InitiateSSO). It returns false if this is IdP-initiated SSO.

3
[quote]
ComponentSpace - 10/26/2021
Hi Dmitry,

The isInResponseTo output parameter isn't available until after the call to SAMLServiceProvider.ReceiveSSO returns.

However, you can call SAMLServiceProvider.IsSSOCompletionPending(), prior to calling SAMLServiceProvider.ReceiveSSO, to determine whether this is IdP-initiated or SP-initiated SSO.

SAMLServiceProvider.IsSSOCompletionPending() returns true if this is SP-initiated SSO (ie there's been a previous call to SAMLServiceProvider.InitiateSSO). It returns false if this is IdP-initiated SSO.
[/quote]

Great, thank you for the response!
4

You’re welcome.