samlshibbolethidp

Shibboleth SP - Only Use GET Method between my SP and the IDP

I want to know if there is a way to only use GET type requests in the exchanges with the IDP. I don't want to use a POST method to exchange with the IDP. Is there a parameter that allows this ?

Solution

  • Take a look at section two of the "Conformance Requirements for the OASIS Security Assertion Markup Language (SAML) V2.0" specification.

    The SAML authn request sent to the IdP may be sent using HTTP-Redirect, HTTP-Post or HTTP-Artifact. The SAML response sent to the SP may be sent using using HTTP-Post or HTTP-Artifact. HTTP-Artifact is rarely used which means the IdP will send the SAML response using HTTP-Post.

    There isn't an option to send the SAML response using an HTTP GET. The reason for this is that SAML responses are generally too long to be encoded as query string parameters.