In the SAML Single Sign-On (SSO) call flow, the following steps occur when a browser client with no existing session attempts to access a protected resource:
1. Initial Access:
The browser client attempts to access a protected resource on the Service Provider (SP), which in this case is a Cisco Unified Communications application.
2. Authentication Request (Correct Answer):
Since there is no existing session, the SP generates a SAML authentication request to initiate the SSO process. This request is formatted according to the SAML protocol and typically includes information about the SP and the requested resource.
3. Redirection to the Identity Provider (IdP):
The SP redirects the browser client, along with the SAML authentication request, to the IdP for user authentication.
4. Authentication and SAML Assertion:
The IdP authenticates the user (e.g., via LDAP or another backend authentication system), generates a SAML assertion, and sends it back to the SP.
5. Resource Access:
The SP validates the SAML assertion, establishes a session for the user, and grants access to the protected resource.