We are building a force.com site application for a company. It will be used by the company's employees who will login into the application using the company's own login page (which uses their own authentication server).
Currently, the company uses SAML (Security Assertion Markup Language) as a single sign-on mechanism where the IDP (Identity Provider) is the company and the service provider is Salesforce. So their employees log in their Salesforce instances using a single sign on page which is maintained by the company.
The company wants the users to log in the force.com site application through this same system. I am confused on how to implement SAML with force.com site. Talking to them it seems they create a server cookie and a session at their backend and it is not sent to the browser as cookie or anything. So what do I check against for a successful login? Any help or suggestions will be much appreciated.