We are an ASP.NET website with 50,000 users. We have one company that wants to use SAML 2.0 to let its 30-or-so employees SSO into our site. I guess that makes their vendor the IdP and us the SP.
Is it really necessary to create a Global.asax file to load the configuration? Can’t we create a page to SAML into (Assertion Consumer Service URL?) and have the load there?
That’s correct. Your site will act as the service provider and the third party site will be the identity provider. If users at the third party site click a link to SSO to your site (rather than starting at your site) then this is IdP-initiated SSO.
An earlier version of our product required an explicit call to load the SAML configuration contained in saml.config. Our recommendation was to make this call from Global.asax.
The current version does not require an explicit call to load saml.config. The configuration will be automatically loaded the first time it’s required.