Documentation
Documentation
Step 1: SAML SSO
Authenticate the user through IdenX using standard SAML 2.0 Single Sign-On. The output is a signed SAML assertion: the proof of identity you exchange for tokens in the following steps.
The SSO round trip
- Your SP builds a SAML
AuthnRequestand sends it to the IdenX SSO endpoint. - IdenX authenticates the user (login + MFA).
- IdenX returns a signed
SAMLResponseto your ACS URL, containing a<saml:Assertion>.
The AuthnRequest
Send a SAML 2.0 AuthnRequest to https://idp.xaa.dev/saml/sso, base64-encoded in a SAMLRequest form field (HTTP-POST binding). The Issuer is your registered SP Entity ID, and the AssertionConsumerServiceURL is your registered ACS URL.
IdenX is a demo IdP. Sign in with any email address and any 6-digit MFA code. The email you enter becomes the NameID (for the Email Address format) and identifies the user throughout the flow.
The assertion is double-signed
IdenX signs the response at two levels:
- the enclosing
<samlp:Response>(the standard SAML SSO signature your SP validates on receipt), and - the
<saml:Assertion>element individually.
The individual assertion signature is what makes the SAML path work. In Step 2 you send only the bare assertion (not the whole Response envelope), and the IdP must be able to verify it on its own. Because IdenX signs the assertion element directly, it is self-verifiable without the surrounding Response.
Extract the bare assertion
Your SP receives the base64-encoded SAMLResponse at its ACS URL. For Step 2, pull out just the <saml:Assertion> element:
This bare <saml:Assertion> is the subject_token for Step 2, per RFC 7521 §3.
A browser-only SP has no server-side ACS route to receive a form POST. For that case, IdenX supports a demo mode: when the ACS URL carries ?demo_mode=popup (localhost only), IdenX's ACS page returns the SAMLResponse to window.opener via postMessage instead of an HTML form POST. This is a playground convenience for single-page demos, not part of the SAML spec. A real server-side SP receives the assertion as a normal HTTP-POST to its ACS.
Next step
With the bare signed assertion in hand, continue to Step 2: Assertion → Refresh Token.
On this page