Default SP session creation in IDP

[Peter Schober]

* Aravindhan A <apitest4 at gmail.com> [2013-11-09 15:06]:
> When the user accessing the IDP login page URL without accessing the SP
> resource, It get authenticated properly, but it the  error page in IDP.

Yes, accessing the IdP's login page directly is not supported.

> Is there any way to redirect the user to the specific SP if the
> session not initiated by the SP(When the user accesses the IDP login
> page directly)?

What is "the specific SP" when there is no request from a SP?  How
should the IDP know which one? Even if your IdP only has metadata for
a single SP configured that is not sufficiently explicit for the IDP
to mean "perform IdP-initiated logins to that entityID".

Two things you can do:

1. Add a check to login.jsp to prevent users being able to
   authenticate when directly accessing that page (because it cannot
   work), e.g via <% if (loginContext == null) {%> <% } %>

2. Use IdP-initiated sessions when everything must start at the IdP.

Both things should be documented.
-peter