# SAML 2.0 SSO flow > Depth-first rabbithole dossier for SAML 2.0 SSO flow; source-anchored research pack. Parent: [Atlas Federated Authentication](https://llms-explorer.com/tree/atlas-federated-authentication/) · 4 facets · 27 facts · page: https://llms-explorer.com/tree/saml-2-0-sso-flow/ ## Definitions - [low] The IdP Single Sign-On URL is a required field specifying the receiver of the SAML AuthNRequest. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The IdP Issuer URI is a required field identifying the issuer of the SAML Assertion. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The RelayState token is an opaque reference to state information maintained at the service provider. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] The SAML application must have an attribute named memberOf, and the group name cannot exceed 200 characters. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` ## Comparisons and alternatives - [low] Bypass SAML Mode provides a login URL that allows authentication with Atlas credentials instead of federated authentication. Sources: https://www.mongodb.com/docs/atlas/security/federation-advanced-options.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` ## Facts and statements - [low] Atlas supports both SP-initiated and IdP-initiated SSO flows for federated authentication. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The Web Browser SAML/SSO Profile with Redirect/POST bindings is one of the most common SSO implementations. Sources: https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The SP saves the requested resource URL in local state information that can persist across the web SSO exchange. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] In IdP-initiated SSO, the IdP is configured with links referring to the local Single Sign-On Service that pass parameters identifying the remote SP. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The SAML trust model requires certificate exchange over trusted channels during setup and does not require CA-signed certificates for the IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] Atlas supports the signature algorithm values SHA-1 and SHA-256 for SAML responses. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] Supported Name ID Formats are urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified and urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [medium] SAML attribute names are case-sensitive and must be typed in camelCase as shown in the documentation. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [medium] If a single domain is mapped to multiple IdPs, users logging in via the MongoDB Cloud console are automatically redirected to the first SAML IdP associated with that domain. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] Each Bypass SAML Mode URL is associated with an individual IdP and corresponds to that IdP's Login URL. Sources: https://www.mongodb.com/docs/atlas/security/federation-advanced-options.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] Bypass SAML Mode is enabled by default but can be disabled as a security measure once Federated Authentication is properly configured. Sources: https://www.mongodb.com/docs/atlas/security/federation-advanced-options.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] In the HTTP Redirect binding, the SP sends an HTTP redirect response (302 or 303) with the AuthnRequest encoded as a URL query variable using DEFLATE encoding. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The browser issues an HTTP GET request to the IdP's Single Sign-On Service with the SAMLRequest query parameter. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The IdP places the Response message in an HTML FORM as a hidden form control named SAMLResponse. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] If the IdP received a RelayState value, it must return it unmodified in a hidden form control named RelayState. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The browser issues an HTTP POST request to send the form to the SP's Assertion Consumer Service. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The SP's Assertion Consumer Service obtains the Response message from the HTML FORM for processing. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The digital signature on the SAML assertion must be validated before processing the assertion contents to create a local logon security context. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The HTTP POST binding may be necessary for AuthnRequest messages where length precludes the use of the HTTP Redirect binding. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] In the Artifact binding, the SP's Assertion Consumer Service sends a SAML ArtifactResolve message to the IdP's Artifact Resolution Service endpoint using a synchronous SOAP message exchange. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] The IdP's Artifact Resolution Service extracts the MessageHandle from the artifact, locates the original SAML Response, and returns it in a SAML ArtifactResponse message over the SOAP channel. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` - [low] Users access the IdP site and click a link to gain access to the remote SP, triggering the creation of a SAML assertion transported via HTTP POST binding. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/saml-2-0-sso-flow-73118297f6/rabbithole-synthesis.md#core` ## Related concepts - SAML — is a part of SAML 2.0 SSO flow - SSO — is a part of SAML 2.0 SSO flow - flow — is a part of SAML 2.0 SSO flow