Shibboleth Authentication request flow

[Peter Schober]

* Sathish Anickode <SAnickode at skytouchtechnology.com> [2014-12-18 04:03]:
> I would like to understand how the authentication request flows
> between the user's browser, SP and IdP.

Then have a look at the many SAML2 intros available on the Internet,
e.g. those that are part of the SAML2 specification itself.
There is no value repeating any of that here.

> A user accesses a resource on a SP for the first time and since
> there is no associated authenticated session, a SAML request is sent
> to the IdP to authenticate the user. Since the user does not have an
> associated session on the IdP, does the IdP send back a SAML
> response requesting the user to be redirected to the login page?

No. Assuming the WebSSO case, the IDP tries to authenticate the subject
by presenting the user agent with some challange (forms based
authentication, HTTP Basic Auth, X.509 client certificate, SPNEGO,
2-factor authn, etc. plus combinations of those). After successfully
authenticating the subject the IDP sends a SAML response to the SP.
-peter