🏢 Enterprise SSO with SAML
SP-initiated single sign-on against the Lab's own SAML 2.0 Identity Provider — a real signed assertion, really validated.
This page is a SIMULATED Service Provider — a teaching stand-in for an
enterprise app that outsources login to SAML. Both the IdP (/saml/sso)
and the SP (/saml/demo-sp/acs) live in this one Lab, so a
simplification was needed: real cross-vendor SAML runs exclusive XML canonicalization
(exc-c14n) so two independent toolkits agree on the exact bytes that were signed.
Here the IdP builds the Assertion with one fixed, deterministic string template, and the SP
re-derives the identical unsigned bytes the same way — a byte-exact stand-in for exc-c14n,
not general canonicalization. Everything else is real: a genuine
RSA-SHA256 enveloped XML-DSig signature (crypto.subtle,
RSASSA-PKCS1-v1_5), a real SHA-256 digest over the Assertion, and every validation check
below runs exactly as a real relying party's would.
Run SP-initiated SSO
1. The SP builds an AuthnRequest → 2. the IdP issues a signed Response → 3. the SP's ACS validates it end to end.