This section provides an overview of the SAML 2.0 bindings you can select as overrides when you add an external identity provider to the Content Innovation Cloud. For detailed information about SAML 2.0 bindings, please refer to the SAML 2.0 specification available at https://www.oasis-open.org/specs.
HTTP-Redirect
The HTTP-Redirect binding allows SAML protocol messages to be passed on the URL query string. HTTP-Redirect is the recommended binding for SAML authentication requests initiated by a service provider, such as the Content Innovation Cloud.
HTTP-Redirect is not recommended for SAML responses (assertions) due to URL length restrictions. For that reason, many identity providers do not allow HTTP-Redirect for SAML responses.
HTTP-POST
The HTTP-POST binding allows SAML protocol messages to be passed using an HTML form control that submits itself using JavaScript. HTTP-POST is the recommended binding for SAML responses (assertions).
HTTP-Artifact
The HTTP-Artifact binding allows SAML protocol messages to be passed using a single-use artifact (an opaque token that is meaningless to the user), which the service provider must exchange to receive user claims data. The artifact is exchanged for the SAML protocol message through direct communication between the identity provider and service provider. The contents of the SAML protocol message are never exposed to the HTTP user agent (the user’s browser).
For the HTTP-Artifact binding to work, the identity provider must be Internet-accessible to the service provider, not restricted behind a firewall. This requirement does not apply to the HTTP-Redirect and HTTP-POST bindings, which work as long as the identity provider is accessible to the end user.