SAML 2.0 SSO flow

Parent: Atlas Federated Authentication · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for SAML 2.0 SSO flow; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] The IdP Single Sign-On URL is a required field specifying the receiver of the SAML AuthNRequest. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] The IdP Issuer URI is a required field identifying the issuer of the SAML Assertion. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] The RelayState token is an opaque reference to state information maintained at the service provider. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]

Problems, failure modes and limitations

[low] The SAML application must have an attribute named memberOf, and the group name cannot exceed 200 characters. Sources: https://www.mongodb.com/docs/atlas/security/manage-role-mapping.md [source]

Comparisons and alternatives

[low] Bypass SAML Mode provides a login URL that allows authentication with Atlas credentials instead of federated authentication. Sources: https://www.mongodb.com/docs/atlas/security/federation-advanced-options.md [source]

Facts and statements

[low] Atlas supports both SP-initiated and IdP-initiated SSO flows for federated authentication. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial [source]
[low] The Web Browser SAML/SSO Profile with Redirect/POST bindings is one of the most common SSO implementations. Sources: https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html [source]
[low] The SP saves the requested resource URL in local state information that can persist across the web SSO exchange. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] In IdP-initiated SSO, the IdP is configured with links referring to the local Single Sign-On Service that pass parameters identifying the remote SP. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The SAML trust model requires certificate exchange over trusted channels during setup and does not require CA-signed certificates for the IdP. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] Atlas supports the signature algorithm values SHA-1 and SHA-256 for SAML responses. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[low] Supported Name ID Formats are urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified and urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md [source]
[medium] SAML attribute names are case-sensitive and must be typed in camelCase as shown in the documentation. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md [source]
[medium] If a single domain is mapped to multiple IdPs, users logging in via the MongoDB Cloud console are automatically redirected to the first SAML IdP associated with that domain. Sources: https://www.mongodb.com/docs/atlas/security/manage-domain-mapping.md, https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md [source]
[low] Each Bypass SAML Mode URL is associated with an individual IdP and corresponds to that IdP's Login URL. Sources: https://www.mongodb.com/docs/atlas/security/federation-advanced-options.md [source]
[low] Bypass SAML Mode is enabled by default but can be disabled as a security measure once Federated Authentication is properly configured. Sources: https://www.mongodb.com/docs/atlas/security/federation-advanced-options.md [source]
[low] In the HTTP Redirect binding, the SP sends an HTTP redirect response (302 or 303) with the AuthnRequest encoded as a URL query variable using DEFLATE encoding. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The browser issues an HTTP GET request to the IdP's Single Sign-On Service with the SAMLRequest query parameter. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The IdP places the Response message in an HTML FORM as a hidden form control named SAMLResponse. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] If the IdP received a RelayState value, it must return it unmodified in a hidden form control named RelayState. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The browser issues an HTTP POST request to send the form to the SP's Assertion Consumer Service. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The SP's Assertion Consumer Service obtains the Response message from the HTML FORM for processing. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The digital signature on the SAML assertion must be validated before processing the assertion contents to create a local logon security context. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The HTTP POST binding may be necessary for AuthnRequest messages where length precludes the use of the HTTP Redirect binding. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] In the Artifact binding, the SP's Assertion Consumer Service sends a SAML ArtifactResolve message to the IdP's Artifact Resolution Service endpoint using a synchronous SOAP message exchange. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] The IdP's Artifact Resolution Service extracts the MessageHandle from the artifact, locates the original SAML Response, and returns it in a SAML ArtifactResponse message over the SOAP channel. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]
[low] Users access the IdP site and click a link to gain access to the remote SP, triggering the creation of a SAML assertion transported via HTTP POST binding. Sources: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html [source]

Related concepts

SAML — is a part of SAML 2.0 SSO flow
SSO — is a part of SAML 2.0 SSO flow
flow — is a part of SAML 2.0 SSO flow

Children

No children recorded.

← the whole tree · 3D view· how to read this page