What is the purpose of a SAML Artifact?

saml saml-2.0 opensaml
funa68 picture funa68 · Nov 29, 2012 · Viewed 41.2k times · Source

I've seen a bunch of flow chart on how it is passed around between Identity Provider (IdP), Service Provider (SP), and Browser via Redirects. However it seems unnecessary to me right now, so i know i'm missing something.

Can someone provide me a use case where a SAML Artifact is required (or very useful) compared to not using one?

Thank you.

Answer

Scott T. picture Scott T. · Nov 29, 2012

Typically, the intent of the artifact binding is to reduce the flow of SAML messages through the browser itself. This could be due to browser restrictions (browsers that have limits on query string / POST payload size) or no support for JavaScript (for auto-submitted forms), or even to improve the security model of how the SAML messages are transported. By using artifacts, sensitive data carried through the SAML Assertion / Attribute Statement is not passed through the browser, so it can be hidden from the end user or attackers between your site and the end user. This confidential data would only be directly resolved between sites through a back channel lookup.

Section 3.6.2 of the SAML 2.0 Bindings specs summarizes it best:

The HTTP Artifact binding is intended for cases in which the SAML requester and responder need to communicate using an HTTP user agent as an intermediary, but the intermediary's limitations preclude or discourage the transmission of an entire message (or message exchange) through it. This may be for technical reasons or because of a reluctance to expose the message content to the intermediary (and if the use of encryption is not practical). Note that because of the need to subsequently resolve the artifact using another synchronous binding, such as SOAP, a direct communication path must exist between the SAML message sender and recipient in the reverse direction of the artifact's transmission (the receiver of the message and artifact must be able to send a request back to the artifact issuer). The artifact issuer must also maintain state while the artifact is pending, which has implications for load-balanced environments.

Related questions

Consume SAMLResponse Token

SAML sp-based authentication has following short workflow. User wants to access application at sp. sp sends SAMLRequest token to idp. idp consume it and generate SAMLResponse token. idp sends this SAMLResponse token to AC-URL given by sp. My Question is …

Read More
What is the point of OpenSAML? Any alternative?

I'm currently working on setting up a SAML IDP. At first, I thought spring-security-saml would help me, but I figured out that it only helps on setting up the SP side of the SAML protocol. So I thought: let's go, …

Read More
Working with SAML 2.0 in C# .NET 4.5

I am trying to use pure .NET (no external classes, controls, helpers) to create a SAML message. I found some code on the interwebs; this is what I have: private static SamlAssertion createSamlAssertion() { // Here we create some SAML assertion with …

Read More