Unsolicited (idp-initiated) Login?

[Cantor, Scott]

On 12/4/14, 1:12 AM, "Jason Walton" <jwalton at outbrain.com> wrote:


>
>If the service (SP) doesn't have a facility for SP-initated SAML login, 
>and I want to enforce SAML across my org - is there a way around 
>providing my users with a link of some sort to click on first?

No, that's the definition of unsolicited login.

>I'm perhaps being a bit intentionally obtuse here - but if I want my 
>users to utilize SAML only, and the service requires unsolicited SAML - 
>don't I *have* to provide a link of some sort to my users? Is there any 
>other way? (now I'm being truly honest and asking).

No. But that's a far cry from OneLogin, and building links on a page 
doesn't exactly warrant its own software project, it's just a web page.

The problem is not building the link or hosting it, the problem is that 
users will ignore it, whatever these vendors seem to want to believe. But 
there's no fix for that, no product you can buy or portal you can run. 
It's just a fundamental obliviousness on the part of vendors to the way 
the web actually works and how SSO has to work to be viable.

The main reason they do it tends to be to ignore IdP discovery.

-- Scott