<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Gaurav,<div><br></div><div>Session initiation can happen in many ways. The SP is in general the right place to perform session initiation, though. Ideally, SP1 and SP2 would both publish session initiation locations in their metadata:</div><div><br></div><div><div><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="https://sp1.com/shibboleth">https://sp1.com/shibboleth</a>"></div><div><br></div><div> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div><div> <md:Extensions></div><div> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="<a href="https://sp1.com/Shibboleth.sso/Login">https://sp1.com/Shibboleth.sso/Login</a>"/></div></div><div><br></div><div><div>...</div><div><br></div><div><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="https://sp2.com/shibboleth">https://sp2.com/shibboleth</a>"></div><div><br></div><div> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div><div> <md:Extensions></div><div> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="<a href="https://sp2.com/Shibboleth.sso/Login">https://sp2.com/Shibboleth.sso/Login</a>"/></div></div><div><br></div><div><br></div><div><br></div><div>When SP1 recognized that the user needed a new session at SP2, it would send the user to the request initiator advertised by SP2 in SP2's metadata.</div><div><br></div><div><a href="https://sp2.com/Shibboleth.sso/Login?entityID=https://your.idp/idp/shibboleth">https://sp2.com/Shibboleth.sso/Login?entityID=https://your.idp/idp/shibboleth</a></div><div><br></div><div>This triggers a chain of redirects that are invisible to the user: SP2 would then send the user to the IdP with an authentication request, and the IdP would check the user's authentication session before using it to mint a fresh assertion for the user for SP2. The user would deliver the assertion to SP2, which would process the assertion and then redirect the user to the web resource.</div><div><br></div><div>I hope this is what you're looking for,</div><div>Nate.</div><div><br></div><div><div><div>On 31 Oct 2012, at 07:18, gaurav sinha <<a href="mailto:gshcet@gmail.com">gshcet@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">Does that mean, from<span class="Apple-converted-space"> </span></span><a href="http://sp1.com/" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">sp1.com</a><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; "><span class="Apple-converted-space"> </span>I will not send a request to<span class="Apple-converted-space"> </span></span><a href="http://sp2.com/" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">sp2.com</a><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; "><span class="Apple-converted-space"> </span>directly,</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">instead I will send a request to IDP which will then redirect to<span class="Apple-converted-space"> </span></span><a href="http://sp2.com/" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">sp2.com</a><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; "><span class="Apple-converted-space"> </span>?<span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "></blockquote></div><br></div></body></html>