One login, many apps.

1. Browser
2. SP
3. IdP

1. GET /dashboard

   Step 1 of 5

   No session at the app

   In plain words You knock at the office door, but you do not have a badge yet.

   The user opens a page of the service provider (SP). There is no session cookie, so the SP has to ask the IdP who this is.

2. 302 → SAMLRequest

   Step 2 of 5

   AuthnRequest through the browser

   In plain words The office gives you a sealed envelope to take to the badge desk.

   The SP builds an AuthnRequest, compresses and encodes it, and redirects the browser to the IdP. RelayState remembers where the user wanted to go.

   GET https://idp.example.com/sso/saml
     ?SAMLRequest=fZJNT8MwDIb/SpV7m6RfqNHaaWyoiAuTKA... (deflate + base64)
     &RelayState=/dashboard
   
   <samlp:AuthnRequest ID="_a1b2c3" Version="2.0"
     Destination="https://idp.example.com/sso/saml"
     AssertionConsumerServiceURL="https://app.example.com/saml/acs">
     <saml:Issuer>https://app.example.com</saml:Issuer>
   </samlp:AuthnRequest>

3. password + codepasskey signature

   Step 3 of 5

   The user signs in once

   In plain words At the badge desk you show your ID once. Next time they already know you.

   The IdP authenticates the user, with MFA if policy requires it. If the user already has an IdP session, this step is skipped: that is the "single" in single sign-on.

4. POST /saml/acs · SAMLResponse

   Step 4 of 5

   Signed assertion back to the app

   In plain words You bring back a letter with an official stamp saying who you are.

   The IdP returns an auto-submitting form that posts the signed response to the SP’s Assertion Consumer Service. The SP checks the signature, Issuer, Audience, Destination, InResponseTo and the NotOnOrAfter time.

   <saml:Assertion ID="_d4e5f6" IssueInstant="2026-10-19T10:00:00Z">
     <saml:Issuer>https://idp.example.com</saml:Issuer>
     <ds:Signature>…</ds:Signature>
     <saml:Subject>
       <saml:NameID Format="…:emailAddress">ada@example.com</saml:NameID>
       <saml:SubjectConfirmationData InResponseTo="_a1b2c3"
         NotOnOrAfter="2026-10-19T10:05:00Z" Recipient="https://app.example.com/saml/acs"/>
     </saml:Subject>
     <saml:Conditions><saml:AudienceRestriction>
       <saml:Audience>https://app.example.com</saml:Audience>
     </saml:AudienceRestriction></saml:Conditions>
     <saml:AttributeStatement>
       <saml:Attribute Name="groups"><saml:AttributeValue>finance</saml:AttributeValue></saml:Attribute>
     </saml:AttributeStatement>
   </saml:Assertion>

5. Set-Cookie · 302 /dashboard

   Step 5 of 5

   Session created

   In plain words The office gives you your own badge: from now on you just walk in.

   The SP creates its own session and sends the user to RelayState. Groups from the assertion can drive roles in the app. Logging out of the SP does not end the IdP session unless single logout is set up.

Flow complete.