<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br>On Fri, 31 Aug 2012, at 16:02 , Chad La Joie <<a href="mailto:lajoie@itumi.biz">lajoie@itumi.biz</a>> wrote:<br><br><blockquote type="cite">Well, if they implemented IdP-initiated SSO then they must be the IdP.<br></blockquote><br>It sounds like it from the (misleading) name, but as Scott & Chad write in the Shibb wiki <<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO</a>>, <br><br><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">In the original SAML 1.0 and SAML 1.1 standards...SSO was described in only ... as a response from the IdP to the SP, and the "request" portion was left out. This was carried over into SAML 2.0 as a mode called "IdP-initiated" or "unsolicited" SSO<br>….the basic idea behind IdP-initiated SSO is that the message is up to the IdP. Something has to initiate the process, it can't magically start for no reason. So there is a request to the IdP, but it isn't a SAML message</blockquote><br>§5.1.4 of the SAML Technical Overview <http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html > is also headed "IdP-Initiated SSO" though it's clear that the service provider is not (necessarily) host the IdP</body></html>