My aim is service provider-initiated Web SSO profile. I am implementing the service provider (SP), using Salesforce as the identity provider (IDP) for testing my SP. Can I use Salesforce IDP?

I have configured Salesforce as my test identity provider for my service provider [I am implementing the SP using the OpenSAML library].

"Edit 1 start"

First of all , can we use salesforce IdP for the sp(locally hosted) intiated sso web profile? I wanted to send my request message to salesForce IdP from my program *

[adding my request messages]

<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://localhost:8080/test_with_OpenSAML/AssertionConsumerService.jsp" ID="7ickdmjo241394083307023" IssueInstant="2014-03-06T05:21:47.115Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ProviderName="ls" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://localhost:8080/test_with_OpenSAML</saml:Issuer></samlp:AuthnRequest>

: In the case of HTTP Redirect , deflating , base64 and url encoding should be done.

after deflating(with zero compression ):SAME REQUEST MESSAGE AS ABOVE [what level of deflating level should I use?]

after base64 encoding :


after URLencoded :[ONLY THE SAMLRequest message should be url encoded]



Is it mandatory to add RelayState?what it should contain?

Edit 1 ends

Once configured I have built the AuthnRequest and by using HTTP POST binding just appended the SAMLREQUEST="URLencodedAuthnRequest" to the POST binding URL of IDP [provided from IDP metadata]

When I send the request message, I see the unable to parse AuthnRequest from service provider error in the Identity Provider Event Log: Service provider is also unknown.why is that so? I have registered my SP as well

Where am I going wrong? I have referred to all the discussions in the Salesforce forums, but I cant find the solution.


With the SAML 2.0 POST binding you have to POST the SAML request in a base64-encoded control within an HTML form - here's an example of what the service provider might send to the browser, from section 3.5.8 of the SAML 2.0 Bindings Specification:

HTTP/1.1 200 OK
Date: 21 Jan 2004 07:00:49 GMT
Content-Type: text/html; charset=iso-8859-1

<?xml version="1.0" encoding="UTF-8"?>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<body onload="document.forms[0].submit()">

<strong>Note:</strong> Since your browser does not support JavaScript,
you must press the Continue button once to proceed.

<form action="https://ServiceProvider.com/SAML/SLO/Browser"
<input type="hidden" name="RelayState"
<input type="hidden" name="SAMLRequest"
<input type="submit" value="Continue"/>

The SAML 2.0 Redirect binding uses a query parameter containing the request, compressed then base64-encoded. Here's an example from section 3.4.8 of the same document:

HTTP/1.1 302 Object Moved
Date: 21 Jan 2004 07:00:49 GMT
Content-Type: text/html; charset=iso-8859-1

Salesforce will accept either binding, using the appropriate URL from the metadata. Render the HTML form, or use the redirect binding, whichever works best for you.

Edit 1 start:

You have http://localhost:8080/test_with_OpenSAML as the Issuer. This element should actually refer to the issuer of the SAML Assertion (the IdP). Use the value from the Identity Provider config in Salesforce - it will be something like https://company-dev-ed.my.salesforce.com.

Also, you have ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" in your request, but you're sending it via redirect. It should be ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect". EDIT - this was incorrect - the ProtocolBinding identifies the protocol binding to use for the SAML response

RelayState is optional. Whatever you pass here, the IdP will pass back to you with the SAML response. RelayState is typically used to hold the URL that the user originally requested, or some handle to that URL.

Edit 1 end.

  • I have tried HTTP redirect as u stated,still the same results persist.@metadaddy – mavis Mar 5 '14 at 7:48
  • Can you edit your question and paste in the request that you're sending? – metadaddy Mar 5 '14 at 16:59
  • 1
    You have the Issuer wrong in the request - see the edit I just made to my answer. – metadaddy Mar 6 '14 at 17:39
  • 1
    The issuer is wrong as you said.I corrected that. ProtocolBinding of mine is correct.That is to notify the IdP to use that binding while sending the response back. – mavis Mar 10 '14 at 8:40
  • 1
    Yes - you are right - SAML Core spec says that ProtocolBinding is "A URI reference that identifies a SAML protocol binding to be used when returning the <Response> message." - I'll edit my answer - thanks! – metadaddy Jun 1 '15 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.