P24

Enterprise SSO with SAML — sign, POST, validate

Run a real SP-initiated SAML 2.0 login: a signed assertion, POSTed, then fully validated.

1
On the SAML lab, click “Sign in with SAML” — the simulated SP builds an AuthnRequest.

SP-initiated SSO starts at the app, not the IdP: the SP sends a short AuthnRequest (its entityID + a fresh ID) to the IdP’s SSO endpoint, HTTP-POST bound — no DEFLATE, just base64.
2
The Lab, as IdP, issues a signed Response containing a real RSA-SHA256 Assertion.

The Assertion carries your NameID, an AudienceRestriction naming the SP, and a 5-minute Conditions window — SHA-256 digested and RSASSA-PKCS1-v1_5 signed with the IdP’s own key, enveloped right after the Issuer element.
3
The simulated SP’s ACS validates every check: signature, issuer, audience, conditions, InResponseTo.

A real relying party trusts NOTHING about a SAML Response until each of these passes — the same validation you’ll see fail on purpose if you tamper with, expire, or misdirect the assertion.

Do it

Do the steps above on the lab page, then come back and check your progress.

Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.