4.1 Message Flows

  • Article

This section describes an example flow of messages among a web browser requestor, a WS resource, a resource IP/STS, and a requestor IP/STS, including example messages.

  1. The web browser requestor sends a GET for the WS resource URL to the WS resource.

  2. The WS resource returns a 302 Redirect to the resource IP/STS at the resource IP/STS URL.

    1. Query string parameters are appended to the IP/STS URL, that forms a wsignin1.0 request message, as follows:

      1. A query string parameter is added, which indicates that WS resource is the resource wanting authentication (wreply).

      2. The original requested WS resource URL is saved as a context parameter in the sign-in message (wctx).

    2. Example URL follows. 

      https://adfsresource1.treyresearch.net/adfs/ls/?wa=wsignin1.0&wreply=
https%3a%2f%2fadfsweb1.treyresearch.net%3a8081%2fclaimapp%2f&wct=
2006-07-11T03%3a26%3a39Z&wctx=https%3a%2f%2fadfsweb1.treyresearch.net
%3a8081%2fclaimapp%2fDefault.aspx

  3. The web browser requestor sends a GET for the resource IP/STS URL.

  4. The resource IP/STS returns a 302 Redirect to the requestor IP/STS URL:

    1. Query string parameters are appended to the requestor IP/STS URL, which form a wsignin1.0 request message (section 2.2.3), as follows:

      1. A query string parameter is added, which indicates that the resource IP/STS is the partner wanting authentication (wtrealm).

      2. Any state required by the resource IP/STS to continue processing the request is saved as a context parameter in the sign-in message (wctx).

    2. Example URL follows. 

      https://adfsaccount1.adatum.com/adfs/ls/auth/integrated/?wa=wsignin1.0
&wtrealm=urn%3afederation%3atreyCrazyResearch&wct=2006-07-11T03%3a28
%3a05Z&wctx=https%3a%2f%2fadfsweb1.treyresearch.net%3a8081%2fclaimapp
%2f%5chttps%3a%2f%2fadfsweb1.treyresearch.net%3a8081%2fclaimapp%2f
Default.aspx

  5. The web browser requestor sends a GET for the requestor IP/STS URL.

    1. Authentication occurs.

  6. The requestor IP/STS sends a 200 response to the client with a POST Redirect to the resource IP/STS URL:

    1. The returned [HTML] contains a hidden form that contains a wsignin1.0 response and JavaScript, which causes the form to POST immediately (optionally the form can have a visible Submit button). The form's target is the resource IP/STS URL.

    2. The response contains a RequestSecurityTokenResponse message that includes a SAML token whose audience is the resource IP/STS. The token is signed by the requestor IP/STS X.509 certificate.

    3. Example form follows. 

      <?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Working...
</title>
</head>
<body>
<form method="POST" action=
"https://adfsresource1.treyresearch.net/adfs/ls/" />
<input type="hidden" name="wa" value="wsignin1.0" />
<input type="hidden" name="wresult" value="
&lt;wst:RequestSecurityTokenResponse xmlns:wst=&quot;
http://schemas.xmlsoap.org/ws/2005/02/trust&quot;>
&lt;wst:RequestedSecurityToken>
&lt;saml:Assertion AssertionID=&quot;
_784067ac-af2c-40b1-993a-cbb376597b6a&quot; 
IssueInstant=&quot;2006-07-11T03:15:40Z&quot; 
Issuer=&quot;urn:federation:apieceodata&quot; 
MajorVersion=&quot;1&quot; MinorVersion=&quot;
1&quot; xmlns:saml=&quot;urn:oasis:names:tc:SAML:1.0:
assertion&quot;>
&lt;saml:Conditions NotBefore=&quot;2006-07-11T03:15:40Z&quot;
 NotOnOrAfter=&quot;2006-07-11T04:15:40Z&quot;>
&lt;saml:AudienceRestrictionCondition>
&lt;saml:Audience>urn:federation:treyCrazyResearch
&lt;/saml:Audience>
&lt;/saml:AudienceRestrictionCondition>
&lt;/saml:Conditions>
&lt;saml:Advice>
&lt;adfs:CookieInfoHash xmlns:adfs=&quot;urn:microsoft:
federation&quot;>11AMDR+AihBUJMPNKS3N64ruuaY=
&lt;/adfs:CookieInfoHash>
&lt;/saml:Advice>
&lt;saml:AuthenticationStatement AuthenticationInstant=&
quot;2006-07-11T03:15:40Z&quot; AuthenticationMethod=
&quot;urn:federation:authentication:windows&quot;>
&lt;saml:Subject>
&lt;saml:NameIdentifier Format=&quot;
http://schemas.xmlsoap.org/claims/UPN&quot;>adamcar@adatum.com
&lt;/saml:NameIdentifier>
&lt;/saml:Subject>
&lt;/saml:AuthenticationStatement>
&lt;saml:AttributeStatement>
&lt;saml:Subject>
&lt;saml:NameIdentifier Format=&quot;
http://schemas.xmlsoap.org/claims/UPN&quot;>adamcar@adatum.com
&lt;/saml:NameIdentifier>
&lt;/saml:Subject>
&lt;saml:Attribute AttributeName=&quot;Group&quot; 
AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
&lt;saml:AttributeValue>ClaimAppMapping
&lt;/saml:AttributeValue>
&lt;/saml:Attribute>
&lt;saml:Attribute AttributeName=&quot;Group&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
&lt;saml:AttributeValue>TokenAppMapping
&lt;/saml:AttributeValue>
&lt;/saml:Attribute>
&lt;saml:Attribute AttributeName=&quot;Group&quot; 
AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
&lt;saml:AttributeValue>ResearchPlatinum
&lt;/saml:AttributeValue>
&lt;/saml:Attribute>
&lt;saml:Attribute AttributeName=&quot;Group&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
&lt;saml:AttributeValue>ResearchPurchaser
&lt;/saml:AttributeValue>
&lt;/saml:Attribute>
&lt;saml:Attribute AttributeName=&quot;ResearchFirstName&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
&lt;saml:AttributeValue>Adam
&lt;/saml:AttributeValue>
&lt;/saml:Attribute>
&lt;/saml:AttributeStatement>
&lt;Signature xmlns=&quot;http://www.w3.org/2000/09/xmldsig#&quot;>
&lt;SignedInfo>
&lt;CanonicalizationMethod Algorithm=&quot;
http://www.w3.org/2001/10/xml-exc-c14n#&quot; />
&lt;SignatureMethod Algorithm=&quot;
http://www.w3.org/2000/09/xmldsig#rsa-sha1&quot; />
&lt;Reference URI=&quot;#_784067ac-af2c-40b1-993a-cbb376597b6a&quot;>
&lt;Transforms>
&lt;Transform Algorithm=&quot;
http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot; />
&lt;Transform Algorithm=&quot;
http://www.w3.org/2001/10/xml-exc-c14n#&quot; />
&lt;/Transforms>
&lt;DigestMethod Algorithm=&quot;
http://www.w3.org/2000/09/xmldsig#sha1&quot; />
&lt;DigestValue>Q4/7YEpc3fTVCzNPop6cyU+VAIE=
&lt;/DigestValue>
&lt;/Reference>
&lt;/SignedInfo>
&lt;SignatureValue>tHgfkoQPiPTXnMWS3K1N6xkL5FOaRzoJIcg0ZqV3CImj
gNtsAGhX8CKCJryYC3ARQdF6jCHHgthnPNyW0jPjA8/VPl1s+Nt5Pe9ODgwhJHx
3wk+gbQs8Ty0IYl+jftp4DM0WF6/LCvIxTmAZ4+GT40fCK9RxbgP4WbR4cj6lE6
C6wwX4odK+lqxVwtR5qx64SUyzPq0zbKG8YX0fSIuSgBJYKLJt+CUk+6YjCeY8m
xH89iL2HWXEBTeMuLh32QrFV2+PFg3jeDcCxCIC9VjwmAyU6VZr3elSpqp/RgtN
Dj8XckSZvwVdOrVztd7sEnJmJmmoeaLpbYNUJWmlbvGsvQ==
&lt;/SignatureValue>
&lt;KeyInfo>
&lt;X509Data>
&lt;X509Certificate>MIIC0jCCAb6gAwIBAgIQKVyguUrraIFEOd4S4lAnOTAJB
gUrDgMCHQUAMCkxJzAlBgNVBAMTHkZlZGVyYXRpb24gU2VydmVyIEFERlNBY2NvdW
50MTAeFw0wNjAxMzEwMjU1MTZaFw0wNzAxMzEwODU1MTZaMCkxJzAlBgNVBAMTHkZ
lZGVyYXRpb24gU2VydmVyIEFERlNBY2NvdW50MTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAL93fgaIJs+E+Y+eYhCrAVHYECQtE43ioEvvljz/4c81eC6i2
Rpiwc+2N+AXWaHqae3vWoCxkTCXWYomm9DXM1JpqTjq0pEWPLjkH7kMa34LUgaKxR
bbmw6Bus9SwGjhCQKdtAwxO9wcp2gEW7FU+gkAtkcoQdv1bEOXwlCInWKXO5jbybT
/l8qGHsz+69fhJdDNoQtjwkIAxqQd9PNdp7r4POG4p5+6kQtkmX3xIWIB0rh0Bml0
9GBbWQUoYbvjx6GH7LB/XJhLIJ7RdIHTv4yS2sTHEgLnF3nx1hjW4cZlznDA7OywV
pZKerK81m7CrHzd78dOJeZYJs2taHUeHY0CAwEAATAJBgUrDgMCHQUAA4IBAQBx9D
BI1t+3/efeQCQVuAwn9yp1nC7CwWGevW8ZyJe5V+3Lx9dQHiO1MpuXpOX+5tEdoDQ
fqjNNvwmA6UM9v1b70CmjWtI/b77scaBAq6B0iQqWlEcyiHKNKjIvF3/ME/SYOL7p
XmY1zvX9EqnOQVtNpLBueeesUo86APAzOqWWWeH5qVwrz73sDoJCToGAtsrnN2b3c
9415u1KSYQNfVQVQl3vCdJXEljuTv0PcGcibgKKT4bEKzHcdkYO38cuuNPgt1a7d0
QnrZ4ZgpjpThLuBLVbzyMP3FiQqFC2hiZ0IKb0uYG5hZY7+wIRhbuYgyqLWsimRL/
aw4m7NdL0RTBO
&lt;/X509Certificate>
&lt;/X509Data>
&lt;/KeyInfo>
&lt;/Signature>
&lt;/saml:Assertion>
&lt;/wst:RequestedSecurityToken>
&lt;wsp:AppliesTo xmlns:wsp=&quot;
http://schemas.xmlsoap.org/ws/2004/09/policy&quot;>
&lt;wsa:EndpointReference xmlns:wsa=&quot;
http://schemas.xmlsoap.org/ws/2004/08/addressing&quot;>
&lt;wsa:Address>urn:federation:treyCrazyResearch
&lt;/wsa:Address>
&lt;/wsa:EndpointReference>
&lt;/wsp:AppliesTo>
&lt;/wst:RequestSecurityTokenResponse>" />
<input type="hidden" name="wctx" value=
"https://adfsweb1.treyresearch.net:8081/claimapp/\
https://adfsweb1.treyresearch.net:8081/claimapp/Default.aspx" />
<noscript>
<p>Script is disabled.  Please click Submit to continue.
</p>
<input type="submit" value="Submit" />
</noscript>
</form>
<script language="javascript">
window.setTimeout('document.forms[0].submit()',0);
</script>
</body>
</html>

  7. The web browser requestor sends a POST to the resource IP/STS URL.

  8. The resource IP/STS sends a 200 response to the client with a POST Redirect to the WS resource URL:

    1. The returned HTML contains a hidden form that contains a wsignin1.0 response and JavaScript, which causes the form to POST immediately (optionally the form can have a visible Submit button). The form's target is the WS resource URL.

    2. The response contains a RequestSecurityTokenResponse message that includes a SAML token whose audience is the WS resource. The token is signed by the resource IP/STS X.509 certificate.

    3. Full-example HTML form follows. 

      <?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head><title>Working...</title></head>
<body>
<form method="POST" action=
"https://adfsweb1.treyresearch.net:8081/claimapp/" />
<input type="hidden" name="wa" value="wsignin1.0" />
<input type="hidden" name="wresult" value="
  &lt;wst:RequestSecurityTokenResponse xmlns:wst=&quot;
http://schemas.xmlsoap.org/ws/2005/02/trust&quot;>
    &lt;wst:RequestedSecurityToken>
      &lt;saml:Assertion AssertionID=&quot;
_f81faa32-fc47-4ddb-98a2-0bda61b7ead2&quot; 
IssueInstant=&quot;2006-07-11T03:19:05Z&quot; 
Issuer=&quot;urn:federation:treyCrazyResearch&quot;             
MajorVersion=&quot;1&quot; MinorVersion=&quot;1&quot; 
xmlns:saml=&quot;urn:oasis:names:tc:SAML:1.0:assertion&quot;>
        &lt;saml:Conditions NotBefore=&quot;
2006-07-11T03:19:05Z&quot;NotOnOrAfter=&quot;
2006-07-11T03:20:05Z&quot;>
          &lt;saml:AudienceRestrictionCondition>
            &lt;saml:Audience>
              https://adfsweb1.treyresearch.net:8081/claimapp/
            &lt;/saml:Audience>
          &lt;/saml:AudienceRestrictionCondition>
        &lt;/saml:Conditions>
        &lt;saml:Advice>
          &lt;adfs:ClaimSource xmlns:adfs=&quot;urn:
microsoft:federation&quot;>
            urn:federation:apieceodata
          &lt;/adfs:ClaimSource>
          &lt;adfs:CookieInfoHash xmlns:adfs=&quot;urn:
microsoft:federation&quot;>
            fA4h78BffP5tdaujuJ39y0b4qEo=
          &lt;/adfs:CookieInfoHash>
        &lt;/saml:Advice>
        &lt;saml:AuthenticationStatement AuthenticationInstant=&
quot;2006-07-11T03:15:40Z&quot; AuthenticationMethod=&quot;
urn:federation:authentication:windows&quot;>
          &lt;saml:Subject>
            &lt;saml:NameIdentifier Format=&quot;
http://schemas.xmlsoap.org/claims/UPN&quot;>
              adamcar@adatum.com
            &lt;/saml:NameIdentifier>
          &lt;/saml:Subject>
        &lt;/saml:AuthenticationStatement>
        &lt;saml:AttributeStatement>
          &lt;saml:Subject>
            &lt;saml:NameIdentifier Format=&quot;
http://schemas.xmlsoap.org/claims/UPN&quot;>
              adamcar@adatum.com
            &lt;/saml:NameIdentifier>
          &lt;/saml:Subject>
          &lt;saml:Attribute AttributeName=&quot;Group&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
            &lt;saml:AttributeValue>
              Adatum TokenApp Claim
            &lt;/saml:AttributeValue>
          &lt;/saml:Attribute>
          &lt;saml:Attribute AttributeName=&quot;Group&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
            &lt;saml:AttributeValue>
              Adatum ClaimApp Claim
            &lt;/saml:AttributeValue>
          &lt;/saml:Attribute>
          &lt;saml:Attribute AttributeName=&quot;Group&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
            &lt;saml:AttributeValue>
              Purchaser
            &lt;/saml:AttributeValue>
          &lt;/saml:Attribute>
          &lt;saml:Attribute AttributeName=&quot;FirstName&quot;
 AttributeNamespace=&quot;http://schemas.xmlsoap.org/claims&quot;>
            &lt;saml:AttributeValue>
              Adam
            &lt;/saml:AttributeValue>
          &lt;/saml:Attribute>
        &lt;/saml:AttributeStatement>
        &lt;Signature xmlns=&quot;
http://www.w3.org/2000/09/xmldsig#&quot;>
          &lt;SignedInfo>
            &lt;CanonicalizationMethod Algorithm=&quot;
http://www.w3.org/2001/10/xml-exc-c14n#&quot; />
            &lt;SignatureMethod Algorithm=&quot;
http://www.w3.org/2000/09/xmldsig#rsa-sha1&quot; />
            &lt;Reference URI=&quot;
#_f81faa32-fc47-4ddb-98a2-0bda61b7ead2&quot;>
              &lt;Transforms>
                &lt;Transform Algorithm=&quot;
http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot; />
                &lt;Transform Algorithm=&quot;
http://www.w3.org/2001/10/xml-exc-c14n#&quot; />
              &lt;/Transforms>
              &lt;DigestMethod Algorithm=&quot;
http://www.w3.org/2000/09/xmldsig#sha1&quot; />
              &lt;DigestValue>
                iLxgLs5ZLZZePFwiGqrGBddqtUI=
              &lt;/DigestValue>
            &lt;/Reference>
          &lt;/SignedInfo>
          &lt;SignatureValue>SeWQYd9ejm1KGmZoi3wWO3wrFGfvtUfBus
7KtdVUovYlha4ov7BVo3NO8lmou/Fd4+dEHbKmgAMWnEgmGygR2bXfNxJzHUvKf
YKCZoZu/T0tB1QK6mvRnMmcMPtLmmXY1Ckkd8Up2oVf7peFHDo1pPlJPUdloYtb
DwBn8Z2Z
                bjN/ktBH9bFRa7A17QM5RhC0/5HKU8n4fHQOZ3GhwXWtfiy
uTFYxjofG9nBm1ehgKXPD3jfTYrP/gCQf4QwCOtQHDyatBDOs/8gEhaTjO49oN8
E8MuaoyGg8kRV7/+K9H6jYD6NlN8e5mAoXW5x1irTFM4yGkLFr8UfVo8PT3pUBg
g==
          &lt;/SignatureValue>
          &lt;KeyInfo>
            &lt;X509Data>
              &lt;X509Certificate>MIIC1DCCAcCgAwIBAgIQ/EU1/PmUxKt
NHdsEKf/aODAJBgUrDgMCHQUAMCoxKDAmBgNVBAMTH0ZlZGVyYXRpb24gU2VydmVy
IEFERlNSZXNvdXJjZTEwHhcNMDYwMTMxMDI1OTAwWhcNMDcwMTMxMDg1O
TAwWjAqMSgwJgYDVQQDEx9GZWRlcmF0aW9uIFNlcnZlciBBREZTUmVzb3VyY2UxMI
IBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAspXHOLNdt4DP7EOT27sQgiR
ILGW9Bsk+HwcGwiTWnedGeG6IJatjragHdW7MYnLrMyiHY9Jc0e4NwzHPDt4qyXlU
C5c8XuHbr74lc32Jq6vlrRWYA/rxo+inRfxCrBkh5SOVRv4fiSyXya6jvbal1EhVc
sORV6g9iG3xW1Ja1GWOfwXUkfPqqeXCJynG/NHe2HqNqPTFCHOoqciHBNHYXZPEo7
W0C8XBPaVOEQ+1pVGaIubbcTsd3I15uuQGAr5Agce/FquUj4BCiQa8UkcTuuF7mmd
SOajnnNS784/5PK3Nc4CTNYiHPUyjg3r/O23z9BaOVIxVgWuTbLr0i/RmtQIDAQAB
MAkGBSsOAwIdBQADggEBAKLIcrdYRgYTYd/HGQCQDOoDrqAQFYDbU72hvPoc5Jknl
wZu3Jc1V8u5ZszRstBenrnJmNWNTBmJrwZ6xRl1eIYNfpCPY5o3dLK6JMSNgp/oT7
7pn6aYZ5/LpxhF3WGWWBg64/n4pOC5SSDteP1PsCm3LjW6Z9zYOL3mkqui3OLqMBK
cCo+JDMMnKgFDqcxutQ3YMPWDuYX+rvabhxMK2JZgWHhXyhWhn2qzi1z5cCFDA1hK
eMBcqDAMFlSsfbejL5tjapuUkiwAraa4BeTCJYz5/w1aeg2XGeTYOFAWPoJG8vvno
n9R37QIBz/Y8IKdDwZc6zAgTJjLZFhDreZbIvM=
              &lt;/X509Certificate>
            &lt;/X509Data>
          &lt;/KeyInfo>
        &lt;/Signature>
      &lt;/saml:Assertion>
    &lt;/wst:RequestedSecurityToken>
    &lt;wsp:AppliesTo xmlns:wsp=&quot;http://schemas.xmlsoap.org/
ws/2004/09/policy&quot;>
      &lt;wsa:EndpointReference xmlns:wsa=&quot;
http://schemas.xmlsoap.org/ws/2004/08/addressing&quot;>
        &lt;wsa:Address>
          https://adfsweb1.treyresearch.net:8081/claimapp/
        &lt;/wsa:Address>
      &lt;/wsa:EndpointReference>
    &lt;/wsp:AppliesTo>
  &lt;/wst:RequestSecurityTokenResponse>" />
<input type="hidden" name="wctx" value="
https://adfsweb1.treyresearch.net:8081/claimapp/Default.aspx" />
<noscript><p>Script is disabled.  
Please click Submit to continue.</p><input type="submit" 
value="Submit" /></noscript></form>
<script language="javascript">
window.setTimeout('document.forms[0].submit()',0);</script>
</body>
</html>

  9. The web browser requestor sends a POST to the WS resource URL.

    1. The WS resource validates the SAML token.

  10. The WS resource returns a 200 response from the application to the client. This message is an internal implementation detail of the WS-Resource and is mentioned here for completeness only. This message is not necessary for interoperability. The WS-Resource is not restricted by the protocol once it has received the token.

    1. The WS resource authorizes a user's request based on attributes from the SAML token.

  11. The web browser requestor continues to browse the application at the WS resource, which results in additional traffic.